Hi Stian, Would it make sense to use Gatekeeper for this? The backend could require bearer tokens as usual but Gatekeeper could be in charge of using the authorisation code flow to log the user in and proxying the frontend's requests to the backend, mapping the cookies to the corresponding bearer tokens. It's probably more limiting than your solution for handling external services, but it could be a quick way of setting up this type of token handling? Kind regards, Seán.