Hi! : ) looking for some oauth advice. I’m tasked with having a public dashboard that has restricted access to a private API (basically just pull and visualize some data) and I’m struggling a bit on how to do this. I was thinking to have the dashboard’s public client (restricted by application uri) authenticate i.e. service accounts, but they seem to only be available with the client credential flow (so it wouldn’t work with a frontend app). I’m wondering if this is a fools errand and we just need to create a limited unauth version of the API, but I’m worried that it would be unwise from a database load perspective to have totally anonymous access. Full disclosure, we have keycloak up currently, but we’re not too entrenched and I’ve been looking for a reason to switch to ory for a while

a client-only app cannot authenticate itself (or rather, it can, but the authentication is meaningless since it is necessarily fully exposed to the user as it runs directly on the user's device), so if your users of this frontend don't authenticate themselves, your only option if you want to keep direct access to the API private is probably to put a trusted gateway between the two (your unauthenticated client app and your private API), where the gateway uses something like client credentials. of course, this effectively means the private API routes you expose in this way are still effectively unauthenticated through this gateway, so it is probably a lot of work for no real effect.