I want to send data from my app to an express js server, and I'd like to protect my api route. In the past I've done this by using keycloak.protect() on the server side, and I put the bearer token in the request in the client side code. However, if I set the response type to token, like this:

const [request, result, promptAsync] = useAuthRequest(
{
clientId: "app_client",
redirectUri: makeRedirectUri({
scheme: "exp",
}),
responseType: "token",
scopes: ["openid", "profile"],
},
discovery
);

then I get an error, stating my keycloak client won't use implicit flow. If I enable it, the token is sent back in the deep link redirect url, which, I believe is not secure. So how should I go about it?

I am trying to use keycloak as my expo authentication but I cannot find any good package or documentations. Does anyone have any suggestions?