Learning slice — BFF reference

Two authorization axes against the assetera realm: the user token (Tokens, proxied to the marketplace API) and a service account (Users, via the Keycloak Admin API). The browser never holds a token — the BFF does.

Not signed in.

What to try

Tokens — any signed-in user sees their tenant's listings; marketplace-admin can add / toggle / delete.
Users — admins only; the BFF reads the realm with its own service-account token, not yours.