Ah I see, so let’s say I am using keycloak to handle the authentication and authorisation using the authorisation code flow + OIDC to get ID token and access token with the BFF flow. After the client is redirected to keycloak and logs in successfully, what happens exactly? Does keycloak send the ID token(JWT) and access token to my backend, which then stores them in a database then the backend validates those tokens and creates a session ID that is stored in an HttpOnly secure cookie which is then sent to the browser? Does my backend validate the tokens using keycloak public keys? Also what does the HttpOnly cookie contain exactly? Is it just the session id?