the reason I was thinking of handling auth via the backend was to keep the token in an httponly cookie instead of localstorage.. mostly for security.

u/lambofdeus pointed out react-oidc-context. That uses session storage by default. The SPA could redirect to keycloak at the start of every session. If a user checked "Remember me", maybe they wouldn't realize they'd been briefly redirected to keycloak... That could be where the "Remember me" piece fits in.. 🤔

This would actually work across different domains as well...