We have a react front channel and a java back channel that will authenticate using the authorization code flow. The front end will invoke a back channel endpoint with the PKCE code verification and the authorization code then the back channel will get the access token with the client secret.

This is the general flow of how we will implement the authentication but how can we secure the back channel endpoint that will retrieve the access token? Is it needed at all?