# Keycloak, Angular, and the BFF Pattern

DevFeed: [Keycloak, Angular, and the BFF Pattern](<https://devfeed.tech/articles/keycloak-angular-and-the-bff-pattern-25134.md>)

Original publisher: [Read original article](<https://blog.brakmic.com/keycloak-angular-and-the-bff-pattern/>)

Author: brakmic

Published: 2025-01-26T10:58:39Z

Content type: tutorial

Language: en

Sources: [Harris Brakmic - Coding](<https://devfeed.tech/sources/harris-brakmic-coding.md>)

Topics: [BFF](<https://devfeed.tech/topics/bff.md>), [Angular](<https://devfeed.tech/topics/angular.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [Express](<https://devfeed.tech/topics/express.md>), [Security](<https://devfeed.tech/topics/security.md>), [web applications](<https://devfeed.tech/topics/web-applications.md>)

Tags: [angular](<https://devfeed.tech/tags/angular.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [bff](<https://devfeed.tech/tags/bff.md>), [coding](<https://devfeed.tech/tags/coding.md>), [express](<https://devfeed.tech/tags/express.md>), [keycloak](<https://devfeed.tech/tags/keycloak.md>), [oauth2](<https://devfeed.tech/tags/oauth2.md>), [oidc](<https://devfeed.tech/tags/oidc.md>), [pkce](<https://devfeed.tech/tags/pkce.md>), [security](<https://devfeed.tech/tags/security.md>), [typescript](<https://devfeed.tech/tags/typescript.md>), [web](<https://devfeed.tech/tags/web.md>), [web-applications](<https://devfeed.tech/tags/web-applications.md>)

## AI overview

This tutorial explains how to use the Backend for Frontend pattern with Angular, Express.js, and Keycloak to secure a web application. It describes handling OAuth2 and PKCE authentication flows server-side, storing tokens in server-side sessions, and keeping sensitive data out of the browser.

## Source excerpt

This article explains implementing the BFF pattern with Angular, Express.js, and Keycloak to secure web applications. Learn how to handle authentication flows server-side, eliminate client-side token storage, and maintain separation between frontend and security operations. Includes practical configuration steps for Keycloak realms, Express.js sessions, and Angular's authentication service.