From d0c9471bef4360cf6134ae033378fd2d6ef8d760 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sn=C3=A6r=20Seljan=20=C3=9E=C3=B3roddsson?=
 <112904566+snaerseljan@users.noreply.github.com>
Date: Thu, 31 Oct 2024 16:12:24 +0000
Subject: [PATCH] feat(services-bff): BFF (Backend for Frontend) (#15835)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* Initial bootstrap for bff

* environment audit not optional

* Add infra file for admin-portal

* Auth login controller and service implemented

* Updates to auth and user modules and services

* Update project readme

* Add secret

* Remove unnecessary config

* Fix env config for ids

* Remove unused util isString

* chore: nx format:write update dirty files

* Rename dto to queries

* Add logout flow

* Finalize logout logic

* Remove proxy

* Move type from service to type file

* chore: nx format:write update dirty files

* Delete libs/auth/react/src/lib/bff/BFFProvider.tsx

* Delete libs/auth/react/src/lib/bff/BFFContext.tsx

* Small refactor in auth service

* Small refactor in test

* Small refactor

* Fix esbuild

* Add scope

* chore: nx format:write update dirty files

* Updates to bff service and client. WIP

* chore: nx format:write update dirty files

* Finishing proxy handling by the bff

* Add scope to token response for backwards compatibility

* Encrypted tokens, hooks update for admin portal, switch user, proxy updated

* feat(proxy-api): Support for proxy api, hooks update, regulations download connection with bff

* Better naming env

* Rename secrets in infra

* Refactor after self review

* Fix test and env cleanup

* Fix user menu test

* Updates to environment and config

* Update infra allowed external api urls to be hard coded

* Simplify client urls with bff postfix in it

* Add ingress to project and remove logout redirect path in favour of client base url

* Add docker express to services bff

* update config simpler syntax

* chore: nx format:write update dirty files

* Update config and redis dev setup

* Update crypto service to include algorithm in the encryption, explain better in comments what encrypt/decrypt is doing and update crypto test to not use mock

* Remove CORS entirely in favour of client proxy config

* Update error handling in bff backend, refactor infra and handle error query param in client

* When proxy service errors then handle as unauthorized. Update targetUrl to be defensive, i.e. no undefined possible.

* Remove unnecessary Uint8Array conversion

* Simplify the BFFUser object to not have dateOfBirth and remove double scope field which was due to backwards compatibility

* Update cookies to share constants, update options to be more secure

* access token expire time latency by 5 sec

* remove omit

* Update user profile cache ttl

* update cache ttl again and rename baseUrl to issuerUrl in ids service

* reaname var

* remove params from cache attempt that where not used in the callback

* Clean up old session in login callback if it exists

* Fix login callback cache clean up and revoke refresh token

* Update logout flow to clean up, revoke tokens and better validation. Also deletes the logout callback

* remove unused import

* Simplify error in favour of enhanced fetch

* created enhanced fetch module, moved pkce service to services, updated proxy service and a little refactor

* par support flag not optional

* Fix typo

* Add better validation to crypto decryption function

* Update validate uri to be more secure, create test for validate uri. Update port range in environment

* Remove state param from logout to ensure it will not be passed to redirect uri

* Adding more tests and increasing security in the function

* Refactor after reading comments from coderabbit

* remove private from method for test

* Move portal scopes to shareable location.

* Remove unused import

* Add no_refresh query to user endpoint in backend

* Polling and broadcaster added to react spa bff library

* Enhanced security in pkce service.and improve error handling to be more secure

* Update usePolling to have better types and secure resumabiltiy.

* Refactor useBroadcaster.

* Add client logic to handle the case if bff server goes down

* Fix tests and builds

* Fix portal infra local vars

* DX infra setup for services-bff

* Remove error log from revokeRefreshToken since it is handled by enhancedFetch and update download service local url

* Rename cached toke fields to be prefixed with encrypted and fix where encryption was missing. Also fix for revoking wrong token

* Better handling on errors in auth service

* Update api requests formatting and handling to handle exceptions and errors better.

* Update apps/services/bff/src/app/bff.config.ts

simpler redis config

Co-authored-by: Eiríkur Heiðar Nilsson <eirikur@nilsson.is>

* cleanup after commit from github

* Update after our pull request AI suggested the change

* Remove broadcaster mocks

* Remove redundant timeout in favour of poller

* Fix portal config, fix redis cache module init, update bff provider to handle logout in before redirect

* Remove timeout in logout broadcasting and throw the error in postRequest if not successful plain text response

* Revert the timeout in the logout

* chore: charts update dirty files

* Rename queries to dto for consistency in monorepo and add log for logout callback

* Fix cli error that got merged from main

* Fix prettier formatting error

* chore: nx format:write update dirty files

* fix storybook build

* ci: trigger from levy user

* fix: use portals-admin, added portal-env test

* Revert manual validation and use library

* Use fetch instead of post in download url

* Fix type errors and add forward get proxy api request

* fix: main conflict

* chore: charts update dirty files

* fix: prettier issues

* chore: prettify

* chore: nx format:write update dirty files

* ci: add services-bff to helm chart

* Fix env vars for feature deploy

* Fix health check to be excluded from prefix

* update global prefix logic

* update bff services options

* Remove bff redis name env var

* Update bff config again

* Update portal env spec for feature branch

* chore: charts update dirty files

* Update validation error log

* Remove database healthcheck

* Revert globalprefix options and update liveness and readiness infra checks

* chore: charts update dirty files

* Add auth controller tests

* Add logout log for testing in feature deploy

* remove unused

* clean up auth controller test

* chore: nx format:write update dirty files

* Add tests for proxy controller

* Add ref to infra for api

* update charts

* add zed editor config to gitignore

* Add support for mocks

* chore: nx format:write update dirty files

* Fix portal env spec

* chore: charts update dirty files

* Update mocking server logic for portals

* update mock logic

* fix: public envs (#16493)

* fix: merge conflict

* fix: improved zod schema generation

* test: update portal-env test for service building

* fix: generate feature deploy urls

* fix: improve getEnvUrl func

* feat: integrated bff to ServiceBuilder

* fix: more abstraction to dsl

* fix: simplify and cleanup

* chore: remove unused file

* chore: cleanup dupes

* chore: nx format:write update dirty files

* chore: more cleanup

---------

Co-authored-by: andes-it <builders@andes.is>

* chore: remove nx-command impl (#16532)

* chore: move nx runcommand cli to a new PR

* chore: commit save point

* chore: commit save point

* Update infra setup

* fix tests

* chore: charts update dirty files

* fix infra url

* Removed un used import

* fix: revert secret type changes

* chore: nx format:write update dirty files

* chore: cleanup

* fix feature deployment url

* fix tests

* fix missing logger

* chore: nx format:write update dirty files

* update api graphql bff config env var

* fix tests

* fix tests

* chore: charts update dirty files

* chore: nx format:write update dirty files

* grantnamespaces

* chore: charts update dirty files

* disable global auth on dev

* chore: charts update dirty files

* Update double negation query param

* feat: Better error message when running infra cli without aws credentials.

* Adding agent to proxy for for managing connections efficiently

* Enable PAR support

* update tests

* chore: charts update dirty files

---------

Co-authored-by: andes-it <builders@andes.is>
Co-authored-by: Eiríkur Heiðar Nilsson <eirikur@nilsson.is>
Co-authored-by: Jón Levy <levy@andes.is>
Co-authored-by: kodiakhq[bot] <49736102+kodiakhq[bot]@users.noreply.github.com>
---
 .gitignore                                    |   2 +
 .prettierignore                               |   2 +-
 .prettierrc                                   |   2 +-
 apps/api/infra/api.ts                         |  45 +-
 apps/api/src/app/environments/environment.ts  |   2 +
 apps/portals/admin/project.json               |  24 +-
 apps/portals/admin/proxy.config.json          |   6 +
 apps/portals/admin/src/app/App.tsx            |  28 +-
 apps/portals/admin/src/auth.ts                |  47 --
 apps/portals/admin/src/graphql.ts             |  12 +-
 apps/portals/admin/src/main.tsx               |   4 +-
 .../my-pages/src/components/Header/Header.tsx |   2 +-
 apps/services/bff/.eslintrc.json              |  18 +
 apps/services/bff/README.md                   |  39 ++
 apps/services/bff/docker-compose.yml          |  14 +
 apps/services/bff/esbuild.json                |  52 ++
 apps/services/bff/infra/admin-portal.infra.ts |  74 +++
 apps/services/bff/jest.config.ts              |  18 +
 apps/services/bff/project.json                |  61 ++
 apps/services/bff/src/app/app.module.ts       |  23 +
 apps/services/bff/src/app/bff.config.ts       | 120 ++++
 .../services/bff/src/app/constants/cookies.ts |   1 +
 apps/services/bff/src/app/constants/time.ts   |   1 +
 .../app/modules/auth/auth.controller.spec.ts  | 539 +++++++++++++++++
 .../src/app/modules/auth/auth.controller.ts   |  66 +++
 .../bff/src/app/modules/auth/auth.module.ts   |  13 +
 .../bff/src/app/modules/auth/auth.service.ts  | 545 ++++++++++++++++++
 .../bff/src/app/modules/auth/auth.types.ts    |  23 +
 .../modules/auth/dto/callback-login.dto.ts    |  25 +
 .../modules/auth/dto/callback-logout.dto.ts   |   7 +
 .../bff/src/app/modules/auth/dto/login.dto.ts |  15 +
 .../src/app/modules/auth/dto/logout.dto.ts    |   6 +
 .../bff/src/app/modules/cache/cache.module.ts |  38 ++
 .../src/app/modules/cache/cache.service.ts    |  65 +++
 .../enhancedFetch/enhanced-fetch.module.ts    |   9 +
 .../enhancedFetch/enhanced-fetch.provider.ts  |  17 +
 .../bff/src/app/modules/ids/ids.service.ts    | 202 +++++++
 .../bff/src/app/modules/ids/ids.types.ts      |  83 +++
 .../app/modules/proxy/dto/api-proxy.dto.ts    |   6 +
 .../modules/proxy/proxy.controller.spec.ts    | 246 ++++++++
 .../src/app/modules/proxy/proxy.controller.ts |  39 ++
 .../bff/src/app/modules/proxy/proxy.module.ts |  13 +
 .../src/app/modules/proxy/proxy.service.ts    | 219 +++++++
 .../bff/src/app/modules/proxy/proxy.types.ts  |   9 +
 .../src/app/modules/user/dto/get-user.dto.ts  |   7 +
 .../src/app/modules/user/user.controller.ts   |  25 +
 .../bff/src/app/modules/user/user.module.ts   |  13 +
 .../bff/src/app/modules/user/user.service.ts  |  82 +++
 .../src/app/services/crypto.service.spec.ts   |  92 +++
 .../bff/src/app/services/crypto.service.ts    | 107 ++++
 .../bff/src/app/services/pkce.service.spec.ts |  74 +++
 .../bff/src/app/services/pkce.service.ts      |  81 +++
 .../src/app/utils/create-error-query-str.ts   |  17 +
 .../app/utils/has-timestamp-expired-in-ms.ts  |   6 +
 .../bff/src/app/utils/qs-validation-pipe.ts   |   7 +
 .../src/app/utils/remove-trailing-slash.ts    |  13 +
 .../bff/src/app/utils/validate-uri.spec.ts    |  84 +++
 .../bff/src/app/utils/validate-uri.ts         |  45 ++
 .../bff/src/environment/environment.schema.ts |  27 +
 .../bff/src/environment/environment.ts        |  12 +
 apps/services/bff/src/environment/index.ts    |   1 +
 apps/services/bff/src/main.ts                 |  12 +
 apps/services/bff/test/setup.ts               |  21 +
 apps/services/bff/test/setupTestServer.ts     |   8 +
 apps/services/bff/test/sharedConstants.ts     |  53 ++
 apps/services/bff/tsconfig.app.json           |   9 +
 apps/services/bff/tsconfig.json               |  13 +
 apps/services/bff/tsconfig.spec.json          |   9 +
 charts/islandis/values.dev.yaml               |  89 ++-
 charts/islandis/values.prod.yaml              |  92 ++-
 charts/islandis/values.staging.yaml           |  90 ++-
 infra/helm/Chart.yaml                         |   4 +
 infra/package.json                            |   2 +
 infra/src/cli/cli.ts                          |   9 +-
 infra/src/cli/render-local-mocks.ts           |   2 +-
 infra/src/dsl/adapters/get-ssm-params.ts      |  12 +-
 infra/src/dsl/bff.ts                          |  83 +++
 infra/src/dsl/dsl.ts                          |  14 +-
 infra/src/dsl/feature-values.spec.ts          |  90 ++-
 infra/src/dsl/portal-env.spec.ts              | 238 ++++++++
 .../pre-process-service.ts                    |   1 -
 infra/src/dsl/types/input-types.ts            |  15 +
 .../dsl/value-files-generators/local-setup.ts |   9 +
 infra/src/feature-env.ts                      |   2 +-
 infra/src/uber-charts/islandis.ts             |  16 +-
 infra/yarn.lock                               | 294 +++++++++-
 libs/auth/scopes/src/index.ts                 |   2 +
 .../src/lib/clients/admin-portal-scopes.ts    |  23 +
 .../src/lib/clients/service-portal-scopes.ts  |  48 ++
 libs/infra-nest-server/src/lib/bootstrap.ts   |  10 +-
 libs/infra-nest-server/src/lib/types.ts       |   6 +
 libs/island-ui/storybook/config/main.ts       |   1 +
 .../admin/application-system/src/module.tsx   |   4 +-
 .../screens/Overview/InstitutionOverview.tsx  |   2 +-
 .../ids-admin/src/hooks/useSuperAdmin.tsx     |   4 +-
 .../src/components/DownloadDraftButton.tsx    |  70 +--
 .../regulations-admin/src/state/reducer.ts    |  19 +-
 .../service-desk/src/screens/Users/Users.tsx  |   4 +-
 .../core/src/components/PortalProvider.tsx    |  14 +-
 .../core/src/components/PortalRouter.tsx      |  18 +-
 libs/portals/core/src/hooks/useModuleProps.ts |   4 +-
 libs/portals/core/src/hooks/useNavigation.ts  |   4 +-
 libs/portals/core/src/index.ts                |   3 +
 libs/portals/core/src/mocks/index.ts          |   1 +
 .../portals/core/src/screens/AccessDenied.tsx |   4 +-
 libs/portals/core/src/screens/ModuleRoute.tsx |   4 +-
 libs/portals/core/src/types/portalCore.ts     |   6 +-
 libs/portals/core/src/utils/modules.ts        |   6 +-
 .../src/utils/router/prepareRouterData.ts     |   6 +-
 .../components/access/AccessConfirmModal.tsx  |   4 +-
 .../AccessDeleteModal/AccessDeleteModal.tsx   |  18 +-
 .../delegations/src/screens/AccessControl.tsx |  11 +-
 .../src/screens/GrantAccess/GrantAccess.tsx   |  24 +-
 libs/react-spa/bff/.babelrc                   |  12 +
 libs/react-spa/bff/.eslintrc.json             |  18 +
 libs/react-spa/bff/README.md                  |   7 +
 libs/react-spa/bff/jest.config.ts             |  11 +
 libs/react-spa/bff/project.json               |  19 +
 libs/react-spa/bff/src/index.ts               |   4 +
 libs/react-spa/bff/src/lib/BffContext.tsx     |  15 +
 libs/react-spa/bff/src/lib/BffPoller.tsx      |  97 ++++
 libs/react-spa/bff/src/lib/BffProvider.tsx    | 237 ++++++++
 .../bff/src/lib/BffSessionExpiredModal.tsx    |  40 ++
 libs/react-spa/bff/src/lib/ErrorScreen.css.ts |   5 +
 libs/react-spa/bff/src/lib/ErrorScreen.tsx    |  41 ++
 libs/react-spa/bff/src/lib/bff.hooks.ts       | 127 ++++
 libs/react-spa/bff/src/lib/bff.mocks.ts       |  19 +
 libs/react-spa/bff/src/lib/bff.state.ts       | 116 ++++
 libs/react-spa/bff/src/lib/bff.utils.ts       |  48 ++
 libs/react-spa/bff/tsconfig.json              |  20 +
 libs/react-spa/bff/tsconfig.lib.json          |  24 +
 libs/react-spa/bff/tsconfig.spec.json         |  20 +
 .../shared/src/hooks/useBroadcaster.ts        | 145 +++++
 .../react-spa/shared/src/hooks/usePolling.tsx | 113 ++++
 libs/react-spa/shared/src/index.ts            |   2 +
 libs/react/feature-flags/src/lib/context.tsx  |  10 +-
 .../UserOnboardingModal/components/Header.tsx |   2 +-
 .../service-portal/information/src/module.tsx |  13 +-
 .../src/auth/UserMenu/UserButton.tsx          |  14 +-
 .../src/auth/UserMenu/UserDelegations.tsx     |  15 +-
 .../src/auth/UserMenu/UserDropdown.tsx        |  37 +-
 .../auth/UserMenu/UserLanguageSwitcher.tsx    |   9 +-
 .../components/src/auth/UserMenu/UserMenu.tsx |   9 +-
 libs/shared/mocking/src/msw/startMocking.ts   |  24 +-
 libs/shared/types/src/index.ts                |   1 +
 libs/shared/types/src/lib/bff.ts              |  24 +
 libs/shared/utils/src/lib/isDelegation.ts     |   4 +-
 libs/testing/nest/src/lib/testServer.ts       |   5 +-
 tsconfig.base.json                            |   1 +
 149 files changed, 5961 insertions(+), 329 deletions(-)
 create mode 100644 apps/portals/admin/proxy.config.json
 delete mode 100644 apps/portals/admin/src/auth.ts
 create mode 100644 apps/services/bff/.eslintrc.json
 create mode 100644 apps/services/bff/README.md
 create mode 100644 apps/services/bff/docker-compose.yml
 create mode 100644 apps/services/bff/esbuild.json
 create mode 100644 apps/services/bff/infra/admin-portal.infra.ts
 create mode 100644 apps/services/bff/jest.config.ts
 create mode 100644 apps/services/bff/project.json
 create mode 100644 apps/services/bff/src/app/app.module.ts
 create mode 100644 apps/services/bff/src/app/bff.config.ts
 create mode 100644 apps/services/bff/src/app/constants/cookies.ts
 create mode 100644 apps/services/bff/src/app/constants/time.ts
 create mode 100644 apps/services/bff/src/app/modules/auth/auth.controller.spec.ts
 create mode 100644 apps/services/bff/src/app/modules/auth/auth.controller.ts
 create mode 100644 apps/services/bff/src/app/modules/auth/auth.module.ts
 create mode 100644 apps/services/bff/src/app/modules/auth/auth.service.ts
 create mode 100644 apps/services/bff/src/app/modules/auth/auth.types.ts
 create mode 100644 apps/services/bff/src/app/modules/auth/dto/callback-login.dto.ts
 create mode 100644 apps/services/bff/src/app/modules/auth/dto/callback-logout.dto.ts
 create mode 100644 apps/services/bff/src/app/modules/auth/dto/login.dto.ts
 create mode 100644 apps/services/bff/src/app/modules/auth/dto/logout.dto.ts
 create mode 100644 apps/services/bff/src/app/modules/cache/cache.module.ts
 create mode 100644 apps/services/bff/src/app/modules/cache/cache.service.ts
 create mode 100644 apps/services/bff/src/app/modules/enhancedFetch/enhanced-fetch.module.ts
 create mode 100644 apps/services/bff/src/app/modules/enhancedFetch/enhanced-fetch.provider.ts
 create mode 100644 apps/services/bff/src/app/modules/ids/ids.service.ts
 create mode 100644 apps/services/bff/src/app/modules/ids/ids.types.ts
 create mode 100644 apps/services/bff/src/app/modules/proxy/dto/api-proxy.dto.ts
 create mode 100644 apps/services/bff/src/app/modules/proxy/proxy.controller.spec.ts
 create mode 100644 apps/services/bff/src/app/modules/proxy/proxy.controller.ts
 create mode 100644 apps/services/bff/src/app/modules/proxy/proxy.module.ts
 create mode 100644 apps/services/bff/src/app/modules/proxy/proxy.service.ts
 create mode 100644 apps/services/bff/src/app/modules/proxy/proxy.types.ts
 create mode 100644 apps/services/bff/src/app/modules/user/dto/get-user.dto.ts
 create mode 100644 apps/services/bff/src/app/modules/user/user.controller.ts
 create mode 100644 apps/services/bff/src/app/modules/user/user.module.ts
 create mode 100644 apps/services/bff/src/app/modules/user/user.service.ts
 create mode 100644 apps/services/bff/src/app/services/crypto.service.spec.ts
 create mode 100644 apps/services/bff/src/app/services/crypto.service.ts
 create mode 100644 apps/services/bff/src/app/services/pkce.service.spec.ts
 create mode 100644 apps/services/bff/src/app/services/pkce.service.ts
 create mode 100644 apps/services/bff/src/app/utils/create-error-query-str.ts
 create mode 100644 apps/services/bff/src/app/utils/has-timestamp-expired-in-ms.ts
 create mode 100644 apps/services/bff/src/app/utils/qs-validation-pipe.ts
 create mode 100644 apps/services/bff/src/app/utils/remove-trailing-slash.ts
 create mode 100644 apps/services/bff/src/app/utils/validate-uri.spec.ts
 create mode 100644 apps/services/bff/src/app/utils/validate-uri.ts
 create mode 100644 apps/services/bff/src/environment/environment.schema.ts
 create mode 100644 apps/services/bff/src/environment/environment.ts
 create mode 100644 apps/services/bff/src/environment/index.ts
 create mode 100644 apps/services/bff/src/main.ts
 create mode 100644 apps/services/bff/test/setup.ts
 create mode 100644 apps/services/bff/test/setupTestServer.ts
 create mode 100644 apps/services/bff/test/sharedConstants.ts
 create mode 100644 apps/services/bff/tsconfig.app.json
 create mode 100644 apps/services/bff/tsconfig.json
 create mode 100644 apps/services/bff/tsconfig.spec.json
 create mode 100644 infra/src/dsl/bff.ts
 create mode 100644 infra/src/dsl/portal-env.spec.ts
 create mode 100644 libs/auth/scopes/src/lib/clients/admin-portal-scopes.ts
 create mode 100644 libs/auth/scopes/src/lib/clients/service-portal-scopes.ts
 create mode 100644 libs/portals/core/src/mocks/index.ts
 create mode 100644 libs/react-spa/bff/.babelrc
 create mode 100644 libs/react-spa/bff/.eslintrc.json
 create mode 100644 libs/react-spa/bff/README.md
 create mode 100644 libs/react-spa/bff/jest.config.ts
 create mode 100644 libs/react-spa/bff/project.json
 create mode 100644 libs/react-spa/bff/src/index.ts
 create mode 100644 libs/react-spa/bff/src/lib/BffContext.tsx
 create mode 100644 libs/react-spa/bff/src/lib/BffPoller.tsx
 create mode 100644 libs/react-spa/bff/src/lib/BffProvider.tsx
 create mode 100644 libs/react-spa/bff/src/lib/BffSessionExpiredModal.tsx
 create mode 100644 libs/react-spa/bff/src/lib/ErrorScreen.css.ts
 create mode 100644 libs/react-spa/bff/src/lib/ErrorScreen.tsx
 create mode 100644 libs/react-spa/bff/src/lib/bff.hooks.ts
 create mode 100644 libs/react-spa/bff/src/lib/bff.mocks.ts
 create mode 100644 libs/react-spa/bff/src/lib/bff.state.ts
 create mode 100644 libs/react-spa/bff/src/lib/bff.utils.ts
 create mode 100644 libs/react-spa/bff/tsconfig.json
 create mode 100644 libs/react-spa/bff/tsconfig.lib.json
 create mode 100644 libs/react-spa/bff/tsconfig.spec.json
 create mode 100644 libs/react-spa/shared/src/hooks/useBroadcaster.ts
 create mode 100644 libs/react-spa/shared/src/hooks/usePolling.tsx
 create mode 100644 libs/shared/types/src/lib/bff.ts

diff --git a/.gitignore b/.gitignore
index 160c3874cac9..a97e5eec68f8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,6 +6,7 @@ tmp/
 out-tsc/
 **/tsconfig.tsbuildinfo
 infra/mountebank-imposter-config.json
+mountebank-imposter-config.json
 infra/helm/**/*.tgz
 
 # dependencies
@@ -96,3 +97,4 @@ apps/**/index.html
 .next
 
 .nx/
+.zed/
diff --git a/.prettierignore b/.prettierignore
index 2619b48cd441..7d2cdb83591b 100644
--- a/.prettierignore
+++ b/.prettierignore
@@ -14,4 +14,4 @@
 /infra/helm/
 /.nx/cache
 /.nx/workspace-data
-apps/web/public/assets/pdf.worker.min.mjs
\ No newline at end of file
+apps/web/public/assets/pdf.worker.min.mjs
diff --git a/.prettierrc b/.prettierrc
index 90779c7c514d..0dc4fc2525df 100644
--- a/.prettierrc
+++ b/.prettierrc
@@ -3,7 +3,7 @@
   "semi": false,
   "trailingComma": "all",
   "arrowParens": "always",
-  "plugins": ["./scripts/prettier-plugins/sort-projects"],
+  "plugins": ["./scripts/prettier-plugins/sort-projects.js"],
   "endOfLine": "lf",
   "overrides": [
     {
diff --git a/apps/api/infra/api.ts b/apps/api/infra/api.ts
index bf069dfb98ce..586dfec4a2b0 100644
--- a/apps/api/infra/api.ts
+++ b/apps/api/infra/api.ts
@@ -1,55 +1,55 @@
 import { json, ref, service, ServiceBuilder } from '../../../infra/src/dsl/dsl'
 import {
   AdrAndMachine,
+  AircraftRegistry,
   Base,
   ChargeFjsV2,
-  EnergyFunds,
   Client,
   CriminalRecord,
+  DirectorateOfImmigration,
   Disability,
+  DistrictCommissionersLicenses,
+  DistrictCommissionersPCard,
   DrivingLicense,
   DrivingLicenseBook,
   Education,
+  EnergyFunds,
   Finance,
   Firearm,
   FishingLicense,
+  Frigg,
+  HealthDirectorateOrganDonation,
+  HealthDirectorateVaccination,
   HealthInsurance,
+  HousingBenefitCalculator,
+  Hunting,
+  IcelandicGovernmentInstitutionVacancies,
+  Inna,
+  IntellectualProperties,
   JudicialAdministration,
+  JudicialSystemServicePortal,
   Labor,
   MunicipalitiesFinancialAid,
   NationalRegistry,
   NationalRegistryB2C,
+  OccupationalLicenses,
+  OfficialJournalOfIceland,
+  OfficialJournalOfIcelandApplication,
   Passports,
   Payment,
   PaymentSchedule,
   Properties,
   RskCompanyInfo,
-  TransportAuthority,
-  Vehicles,
-  VehiclesMileage,
-  VehicleServiceFjsV1,
-  WorkMachines,
-  IcelandicGovernmentInstitutionVacancies,
   RskProcuring,
-  AircraftRegistry,
-  HousingBenefitCalculator,
-  OccupationalLicenses,
   ShipRegistry,
-  DistrictCommissionersPCard,
-  DistrictCommissionersLicenses,
-  DirectorateOfImmigration,
-  Hunting,
   SignatureCollection,
   SocialInsuranceAdministration,
-  IntellectualProperties,
-  Inna,
+  TransportAuthority,
   UniversityCareers,
-  OfficialJournalOfIceland,
-  OfficialJournalOfIcelandApplication,
-  JudicialSystemServicePortal,
-  Frigg,
-  HealthDirectorateOrganDonation,
-  HealthDirectorateVaccination,
+  Vehicles,
+  VehicleServiceFjsV1,
+  VehiclesMileage,
+  WorkMachines,
 } from '../../../infra/src/dsl/xroad'
 
 export const serviceSetup = (services: {
@@ -469,5 +469,6 @@ export const serviceSetup = (services: {
       'api-catalogue',
       'application-system',
       'consultation-portal',
+      'services-bff-portals-admin',
     )
 }
diff --git a/apps/api/src/app/environments/environment.ts b/apps/api/src/app/environments/environment.ts
index 588fbe19ccfe..2d5faa33b286 100644
--- a/apps/api/src/app/environments/environment.ts
+++ b/apps/api/src/app/environments/environment.ts
@@ -97,6 +97,7 @@ const prodConfig = () => ({
     basePath: process.env.ISLYKILL_SERVICE_BASEPATH,
   },
 })
+
 const devConfig = () => ({
   production: false,
   xroad: {
@@ -207,6 +208,7 @@ const devConfig = () => ({
     basePath: process.env.ISLYKILL_SERVICE_BASEPATH,
   },
 })
+
 export const getConfig =
   process.env.PROD_MODE === 'true' || process.env.NODE_ENV === 'production'
     ? prodConfig()
diff --git a/apps/portals/admin/project.json b/apps/portals/admin/project.json
index d7fc9572a5f0..53dda7697770 100644
--- a/apps/portals/admin/project.json
+++ b/apps/portals/admin/project.json
@@ -55,7 +55,8 @@
       "executor": "@nx/webpack:dev-server",
       "options": {
         "buildTarget": "portals-admin:build",
-        "hmr": true
+        "hmr": true,
+        "proxyConfig": "apps/portals/admin/proxy.config.json"
       },
       "configurations": {
         "production": {
@@ -92,11 +93,28 @@
         "parallel": false
       }
     },
+    "start-bff": {
+      "executor": "nx:run-commands",
+      "options": {
+        "commands": [
+          "node -r esbuild-register src/cli/cli.ts run-local-env services-bff-portals-admin"
+        ],
+        "cwd": "infra"
+      }
+    },
     "dev": {
       "executor": "nx:run-commands",
       "options": {
-        "commands": ["yarn start portals-admin"],
-        "parallel": true
+        "commands": [
+          "yarn nx run portals-admin:start-bff",
+          "yarn start portals-admin"
+        ]
+      }
+    },
+    "mockmode": {
+      "executor": "nx:run-commands",
+      "options": {
+        "commands": ["API_MOCKS=true yarn start portals-admin"]
       }
     },
     "docker-static": {
diff --git a/apps/portals/admin/proxy.config.json b/apps/portals/admin/proxy.config.json
new file mode 100644
index 000000000000..8f1d53118e19
--- /dev/null
+++ b/apps/portals/admin/proxy.config.json
@@ -0,0 +1,6 @@
+{
+  "/stjornbord/bff/*": {
+    "target": "http://localhost:3010",
+    "secure": false
+  }
+}
diff --git a/apps/portals/admin/src/app/App.tsx b/apps/portals/admin/src/app/App.tsx
index 918f04a4307c..1627e3b6aa17 100644
--- a/apps/portals/admin/src/app/App.tsx
+++ b/apps/portals/admin/src/app/App.tsx
@@ -1,20 +1,34 @@
 import { ApolloProvider } from '@apollo/client'
-import { AuthProvider } from '@island.is/auth/react'
 import { LocaleProvider } from '@island.is/localization'
-import { defaultLanguage } from '@island.is/shared/constants'
+import {
+  ApplicationErrorBoundary,
+  PortalRouter,
+  isMockMode,
+} from '@island.is/portals/core'
+import { BffProvider, createMockedInitialState } from '@island.is/react-spa/bff'
 import { FeatureFlagProvider } from '@island.is/react/feature-flags'
-import { ApplicationErrorBoundary, PortalRouter } from '@island.is/portals/core'
-import { modules } from '../lib/modules'
-import { client } from '../graphql'
+import { defaultLanguage } from '@island.is/shared/constants'
 import environment from '../environments/environment'
+import { client } from '../graphql'
+import { modules } from '../lib/modules'
 import { AdminPortalPaths } from '../lib/paths'
 import { createRoutes } from '../lib/routes'
+import { adminPortalScopes } from '@island.is/auth/scopes'
+
+const mockedInitialState = isMockMode
+  ? createMockedInitialState({
+      scopes: adminPortalScopes,
+    })
+  : undefined
 
 export const App = () => (
   <ApolloProvider client={client}>
     <LocaleProvider locale={defaultLanguage} messages={{}}>
       <ApplicationErrorBoundary>
-        <AuthProvider basePath={AdminPortalPaths.Base}>
+        <BffProvider
+          applicationBasePath={AdminPortalPaths.Base}
+          mockedInitialState={mockedInitialState}
+        >
           <FeatureFlagProvider sdkKey={environment.featureFlagSdkKey}>
             <PortalRouter
               modules={modules}
@@ -26,7 +40,7 @@ export const App = () => (
               }}
             />
           </FeatureFlagProvider>
-        </AuthProvider>
+        </BffProvider>
       </ApplicationErrorBoundary>
     </LocaleProvider>
   </ApolloProvider>
diff --git a/apps/portals/admin/src/auth.ts b/apps/portals/admin/src/auth.ts
deleted file mode 100644
index 944cdc454551..000000000000
--- a/apps/portals/admin/src/auth.ts
+++ /dev/null
@@ -1,47 +0,0 @@
-import { configure, configureMock } from '@island.is/auth/react'
-import { AdminPortalScope } from '@island.is/auth/scopes'
-
-import environment from './environments/environment'
-
-const userMocked = process.env.API_MOCKS === 'true'
-
-if (userMocked) {
-  configureMock({
-    profile: { name: 'Mock', locale: 'is', nationalId: '0000000000' },
-    scopes: [],
-  })
-} else {
-  configure({
-    baseUrl: `${window.location.origin}/stjornbord`,
-    redirectPath: '/signin-oidc',
-    redirectPathSilent: '/silent/signin-oidc',
-    switchUserRedirectUrl: '/',
-    authority: environment.identityServer.authority,
-    client_id: '@admin.island.is/web',
-    scope: [
-      'openid',
-      'profile',
-      AdminPortalScope.delegations,
-      AdminPortalScope.airDiscountScheme,
-      AdminPortalScope.regulationAdmin,
-      AdminPortalScope.regulationAdminManage,
-      AdminPortalScope.icelandicNamesRegistry,
-      AdminPortalScope.applicationSystemAdmin,
-      AdminPortalScope.applicationSystemInstitution,
-      AdminPortalScope.documentProvider,
-      AdminPortalScope.idsAdmin,
-      AdminPortalScope.idsAdminSuperUser,
-      AdminPortalScope.petitionsAdmin,
-      AdminPortalScope.serviceDesk,
-      AdminPortalScope.explicitAirDiscountScheme,
-      AdminPortalScope.signatureCollectionManage,
-      AdminPortalScope.signatureCollectionProcess,
-      AdminPortalScope.formSystem,
-      AdminPortalScope.formSystemSuperUser,
-      AdminPortalScope.delegationSystem,
-      AdminPortalScope.delegationSystemAdmin,
-    ],
-    post_logout_redirect_uri: `${window.location.origin}`,
-    userStorePrefix: 'ap.',
-  })
-}
diff --git a/apps/portals/admin/src/graphql.ts b/apps/portals/admin/src/graphql.ts
index d20d4f3df080..9f31915d3166 100644
--- a/apps/portals/admin/src/graphql.ts
+++ b/apps/portals/admin/src/graphql.ts
@@ -8,16 +8,10 @@ import {
 import { onError } from '@apollo/client/link/error'
 import { RetryLink } from '@apollo/client/link/retry'
 
-import { authLink } from '@island.is/auth/react'
-
-const uri =
-  process.env.NODE_ENV === 'development'
-    ? 'http://localhost:4444/api/graphql'
-    : '/api/graphql'
-
 const httpLink = new HttpLink({
-  uri: ({ operationName }) => `${uri}?op=${operationName}`,
+  uri: ({ operationName }) => `/stjornbord/bff/api/graphql?op=${operationName}`,
   fetch,
+  credentials: 'include',
 })
 
 const retryLink = new RetryLink()
@@ -34,7 +28,7 @@ const errorLink = onError(({ graphQLErrors, networkError }) => {
 })
 
 export const client = new ApolloClient({
-  link: ApolloLink.from([retryLink, errorLink, authLink, httpLink]),
+  link: ApolloLink.from([retryLink, errorLink, httpLink]),
   cache: new InMemoryCache({
     typePolicies: {
       UserProfile: {
diff --git a/apps/portals/admin/src/main.tsx b/apps/portals/admin/src/main.tsx
index 0d8890a30cbb..4cca91a26a05 100644
--- a/apps/portals/admin/src/main.tsx
+++ b/apps/portals/admin/src/main.tsx
@@ -1,11 +1,11 @@
 import '@island.is/api/mocks'
+
 import { userMonitoring } from '@island.is/user-monitoring'
-import React, { StrictMode } from 'react'
+import { StrictMode } from 'react'
 import { createRoot } from 'react-dom/client'
 
 import { isRunningOnEnvironment } from '@island.is/shared/utils'
 
-import './auth'
 import environment from './environments/environment'
 import { App } from './app/App'
 
diff --git a/apps/portals/my-pages/src/components/Header/Header.tsx b/apps/portals/my-pages/src/components/Header/Header.tsx
index 21c913b99da0..f3d09e9f596d 100644
--- a/apps/portals/my-pages/src/components/Header/Header.tsx
+++ b/apps/portals/my-pages/src/components/Header/Header.tsx
@@ -130,7 +130,7 @@ export const Header = ({ position }: Props) => {
                         />
                       )}
 
-                      {user && <UserLanguageSwitcher user={user} />}
+                      {user && <UserLanguageSwitcher />}
 
                       <Box className={styles.overview} marginRight={[1, 1, 2]}>
                         <Button
diff --git a/apps/services/bff/.eslintrc.json b/apps/services/bff/.eslintrc.json
new file mode 100644
index 000000000000..3456be9b9036
--- /dev/null
+++ b/apps/services/bff/.eslintrc.json
@@ -0,0 +1,18 @@
+{
+  "extends": ["../../../.eslintrc.json"],
+  "ignorePatterns": ["!**/*"],
+  "overrides": [
+    {
+      "files": ["*.ts", "*.tsx", "*.js", "*.jsx"],
+      "rules": {}
+    },
+    {
+      "files": ["*.ts", "*.tsx"],
+      "rules": {}
+    },
+    {
+      "files": ["*.js", "*.jsx"],
+      "rules": {}
+    }
+  ]
+}
diff --git a/apps/services/bff/README.md b/apps/services/bff/README.md
new file mode 100644
index 000000000000..a2c7452afc20
--- /dev/null
+++ b/apps/services/bff/README.md
@@ -0,0 +1,39 @@
+# BFF (Backend for Frontend)
+
+## About
+
+The BFF (Backend for Frontend) service serves as an intermediary layer for multiple clients, such as the admin portal, service portal, and other applications. It is designed to centralize authentication and business logic, ensuring a secure and streamlined communication process between clients and backend resources.
+
+This service handles user authentication through our IdentityServer, facilitating secure access and session management. Once authenticated, the BFF proxies and manages requests to our GraphQL API, ensuring only authorized requests are processed.
+
+## Getting Started
+
+To set up and run the BFF service, use the following commands:
+
+### Start Development Server
+
+`yarn start services-bff`
+Starts the service on `localhost:3010`.
+
+### Build for Production
+
+`yarn nx build services-bff`
+Builds the service to `dist/apps/services/bff`.
+For production: `nx build services-bff --configuration=production`
+
+### Lint Code
+
+`yarn nx lint services-bff`
+
+### Run Tests
+
+`yarn nx test services-bff`
+Runs tests with Jest and outputs coverage to `coverage/apps/services/bff`.
+
+### Starts Redis server with Docker
+
+`yarn nx dev-services services-bff`
+
+## Code owners and maintainers
+
+- [Aranja](https://github.com/orgs/island-is/teams/aranja/members)
diff --git a/apps/services/bff/docker-compose.yml b/apps/services/bff/docker-compose.yml
new file mode 100644
index 000000000000..d6df1d4b1fc6
--- /dev/null
+++ b/apps/services/bff/docker-compose.yml
@@ -0,0 +1,14 @@
+version: '3.3'
+
+services:
+  redis-cluster:
+    container_name: bff_redis_cluster
+    image: docker.io/grokzen/redis-cluster:6.0.16
+    privileged: true
+    environment:
+      - IP=0.0.0.0
+    ports:
+      - '7000-7005:7000-7005'
+
+networks:
+  local:
diff --git a/apps/services/bff/esbuild.json b/apps/services/bff/esbuild.json
new file mode 100644
index 000000000000..3a039143f18e
--- /dev/null
+++ b/apps/services/bff/esbuild.json
@@ -0,0 +1,52 @@
+{
+  "platform": "node",
+  "external": [
+    "fsevents",
+    "@nestjs/microservices",
+    "class-transformer",
+    "cache-manager",
+    "@nestjs/websockets/socket-module",
+    "class-validator",
+    "class-transformer",
+    "@nestjs/microservices/microservices-module",
+    "apollo-server-fastify",
+    "@elastic/elasticsearch",
+    "fastify-swagger",
+    "@nestjs/mongoose",
+    "@nestjs/typeorm",
+    "dd-trace",
+    "express",
+    "http-errors",
+    "graphql",
+    "pg",
+    "winston",
+    "util-deprecate",
+    "source-map-resolve",
+    "atob",
+    "logform",
+    "pg-native",
+    "form-data",
+    "bull",
+    "ioredis",
+    "p-map",
+    "lru-cache",
+    "pdfkit",
+    "tslib",
+    "sequelize",
+    "configcat-node",
+    "@protobufjs/aspromise",
+    "@protobufjs/base64",
+    "@protobufjs/codegen",
+    "@protobufjs/eventemitter",
+    "@protobufjs/fetch",
+    "@protobufjs/float",
+    "@protobufjs/inquire",
+    "@protobufjs/path",
+    "@protobufjs/pool",
+    "@protobufjs/utf8",
+    "pseudomap",
+    "safer-buffer",
+    "@mikro-orm/core"
+  ],
+  "keepNames": true
+}
diff --git a/apps/services/bff/infra/admin-portal.infra.ts b/apps/services/bff/infra/admin-portal.infra.ts
new file mode 100644
index 000000000000..f04db09065bd
--- /dev/null
+++ b/apps/services/bff/infra/admin-portal.infra.ts
@@ -0,0 +1,74 @@
+/* eslint-disable @nx/enforce-module-boundaries */
+import { ServiceBuilder, json, service } from '../../../../infra/src/dsl/dsl'
+import { BffInfraServices } from '../../../../infra/src/dsl/types/input-types'
+
+const bffName = 'services-bff'
+const clientName = 'portals-admin'
+const serviceName = `${bffName}-${clientName}`
+const key = 'stjornbord'
+
+export const serviceSetup = (
+  services: BffInfraServices,
+): ServiceBuilder<typeof serviceName> =>
+  service(serviceName)
+    .namespace(clientName)
+    .image(bffName)
+    .redis()
+    .serviceAccount(bffName)
+    .env({
+      BFF_ALLOWED_EXTERNAL_API_URLS: {
+        local: json(['http://localhost:3377/download/v1']),
+        dev: json(['https://api.dev01.devland.is']),
+        staging: json(['https://api.staging01.devland.is']),
+        prod: json(['https://api.island.is']),
+      },
+    })
+    .bff({
+      key,
+      clientId: `@admin.island.is/bff-${key}`,
+      clientName,
+      services,
+    })
+    .readiness(`/${key}/bff/health/check`)
+    .liveness(`/${key}/bff/liveness`)
+    .replicaCount({
+      default: 2,
+      min: 2,
+      max: 10,
+    })
+    .resources({
+      limits: {
+        cpu: '400m',
+        memory: '512Mi',
+      },
+      requests: {
+        cpu: '100m',
+        memory: '256Mi',
+      },
+    })
+    .ingress({
+      primary: {
+        host: {
+          dev: ['beta'],
+          staging: ['beta'],
+          prod: ['', 'www.island.is'],
+        },
+        extraAnnotations: {
+          dev: {
+            'nginx.ingress.kubernetes.io/proxy-buffering': 'on',
+            'nginx.ingress.kubernetes.io/proxy-buffer-size': '8k',
+          },
+          staging: {
+            'nginx.ingress.kubernetes.io/enable-global-auth': 'false',
+            'nginx.ingress.kubernetes.io/proxy-buffering': 'on',
+            'nginx.ingress.kubernetes.io/proxy-buffer-size': '8k',
+          },
+          prod: {
+            'nginx.ingress.kubernetes.io/proxy-buffering': 'on',
+            'nginx.ingress.kubernetes.io/proxy-buffer-size': '8k',
+          },
+        },
+        paths: ['/stjornbord/bff'],
+      },
+    })
+    .grantNamespaces('identity-server')
diff --git a/apps/services/bff/jest.config.ts b/apps/services/bff/jest.config.ts
new file mode 100644
index 000000000000..3564c051f849
--- /dev/null
+++ b/apps/services/bff/jest.config.ts
@@ -0,0 +1,18 @@
+/* eslint-disable */
+export default {
+  preset: './jest.preset.js',
+  rootDir: '../../..',
+  roots: [__dirname],
+  transform: {
+    '^.+\\.[tj]sx?$': [
+      'ts-jest',
+      { tsconfig: `${__dirname}/tsconfig.spec.json` },
+    ],
+  },
+  testEnvironment: 'node',
+  moduleFileExtensions: ['ts', 'tsx', 'js', 'jsx', 'html'],
+  coverageDirectory: '<rootDir>/coverage/apps/services/bff',
+  displayName: 'bff',
+  collectCoverageFrom: ['src/**/*.ts'],
+  setupFilesAfterEnv: [`${__dirname}/test/setup.ts`],
+}
diff --git a/apps/services/bff/project.json b/apps/services/bff/project.json
new file mode 100644
index 000000000000..f7639e9050f0
--- /dev/null
+++ b/apps/services/bff/project.json
@@ -0,0 +1,61 @@
+{
+  "name": "services-bff",
+  "$schema": "../../../node_modules/nx/schemas/project-schema.json",
+  "sourceRoot": "apps/services/bff/src",
+  "projectType": "application",
+  "prefix": "services-bff",
+  "tags": ["scope:services-bff"],
+  "targets": {
+    "build": {
+      "executor": "./tools/executors/node:build",
+      "options": {
+        "outputPath": "dist/apps/services/bff",
+        "main": "apps/services/bff/src/main.ts",
+        "tsConfig": "apps/services/bff/tsconfig.app.json",
+        "maxWorkers": 2
+      },
+      "configurations": {
+        "production": {
+          "optimization": true,
+          "extractLicenses": true,
+          "inspect": false
+        }
+      },
+      "outputs": ["{options.outputPath}"]
+    },
+    "serve": {
+      "executor": "@nx/js:node",
+      "options": {
+        "buildTarget": "services-bff:build"
+      }
+    },
+    "lint": {
+      "executor": "@nx/eslint:lint"
+    },
+    "test": {
+      "executor": "@nx/jest:jest",
+      "options": {
+        "jestConfig": "apps/services/bff/jest.config.ts",
+        "runInBand": true
+      },
+      "outputs": ["{workspaceRoot}/coverage/apps/services/bff"]
+    },
+    "dev-services": {
+      "executor": "nx:run-commands",
+      "options": {
+        "command": "docker compose up -d",
+        "cwd": "apps/services/bff"
+      }
+    },
+    "dev": {
+      "executor": "nx:run-commands",
+      "options": {
+        "commands": ["yarn start services-bff"],
+        "parallel": true
+      }
+    },
+    "docker-express": {
+      "executor": "Intentionally left blank, only so this target is valid when using `nx show projects --with-target docker-express`"
+    }
+  }
+}
diff --git a/apps/services/bff/src/app/app.module.ts b/apps/services/bff/src/app/app.module.ts
new file mode 100644
index 000000000000..923f19224d97
--- /dev/null
+++ b/apps/services/bff/src/app/app.module.ts
@@ -0,0 +1,23 @@
+import { ConfigModule } from '@island.is/nest/config'
+import { Module } from '@nestjs/common'
+import { BffConfig } from './bff.config'
+import { AuthModule as AppAuthModule } from './modules/auth/auth.module'
+import { CacheModule } from './modules/cache/cache.module'
+import { ProxyModule } from './modules/proxy/proxy.module'
+import { UserModule } from './modules/user/user.module'
+import { EnhancedFetchModule } from './modules/enhancedFetch/enhanced-fetch.module'
+
+@Module({
+  imports: [
+    CacheModule.register(),
+    ConfigModule.forRoot({
+      isGlobal: true,
+      load: [BffConfig],
+    }),
+    UserModule,
+    AppAuthModule,
+    ProxyModule,
+    EnhancedFetchModule,
+  ],
+})
+export class AppModule {}
diff --git a/apps/services/bff/src/app/bff.config.ts b/apps/services/bff/src/app/bff.config.ts
new file mode 100644
index 000000000000..a4fd95d97d40
--- /dev/null
+++ b/apps/services/bff/src/app/bff.config.ts
@@ -0,0 +1,120 @@
+import { defineConfig } from '@island.is/nest/config'
+
+import { z } from 'zod'
+import { removeTrailingSlash } from './utils/remove-trailing-slash'
+
+export const idsSchema = z.strictObject({
+  issuer: z.string(),
+  clientId: z.string(),
+  scopes: z.string().array(),
+  secret: z.string(),
+})
+
+const BffConfigSchema = z.object({
+  /**
+   * Redis configuration
+   */
+  redis: z.object({
+    name: z.string(),
+    nodes: z.array(z.string()),
+    ssl: z.boolean(),
+  }),
+  graphqlApiEndpoint: z.string(),
+  /**
+   * The URL to redirect to after logging out
+   */
+  logoutRedirectUri: z.string(),
+  /**
+   * Bff client base URL
+   */
+  clientBaseUrl: z.string(),
+  ids: idsSchema,
+  /**
+   * The base64 encoded secret used for encrypting and decrypting tokens.
+   */
+  tokenSecretBase64: z.string(),
+  /**
+   * Determines if the BFF should support the PAR (Pushed Authorization Requests) flow or normal login flow
+   */
+  parSupportEnabled: z.boolean(),
+  /**
+   * Allowed external API URLs that the BFF can proxy requests to
+   */
+  allowedExternalApiUrls: z.array(z.string()),
+  allowedRedirectUris: z.string().array(),
+  callbacksRedirectUris: z.strictObject({
+    login: z.string(),
+    logout: z.string(),
+  }),
+  /**
+   * Time-to-live (TTL) for caching the user profile, in milliseconds.
+   * This value determines how long the user profile will be cached before it is considered stale.
+   *
+   * Note: The TTL should be aligned with the lifespan of the Ids client refresh token.
+   *       We also subtract 5 seconds from the TTL to handle latency and clock drift.
+   */
+  cacheUserProfileTTLms: z.number(),
+  /**
+   * Time-to-live (TTL) for caching the login attempts, in milliseconds.
+   */
+  cacheLoginAttemptTTLms: z.number(),
+})
+
+export const BffConfig = defineConfig({
+  name: 'BffConfig',
+  schema: BffConfigSchema,
+  load(env) {
+    const callbacksBaseRedirectPath = removeTrailingSlash(
+      env.required('BFF_CALLBACKS_BASE_PATH'),
+    )
+    const bffName = env.required('BFF_NAME')
+
+    return {
+      parSupportEnabled: env.optionalJSON('BFF_PAR_SUPPORT_ENABLED') ?? false,
+      clientBaseUrl: env.required('BFF_CLIENT_BASE_URL'),
+      logoutRedirectUri: env.required('BFF_LOGOUT_REDIRECT_URI'),
+      /**
+       * Our main GraphQL API endpoint
+       */
+      graphqlApiEndpoint: env.required('BFF_PROXY_API_ENDPOINT'),
+      redis: {
+        name: `bff-${bffName}`,
+        // Redis nodes are only required in production
+        // In development, we can use a local Redis server or
+        // rely on the default in-memory cache provided by CacheModule
+        nodes: env.requiredJSON('REDIS_URL_NODE_01', []),
+        ssl: env.optionalJSON('BFF_REDIS_SSL', false) ?? true,
+      },
+      ids: {
+        issuer: env.required('IDENTITY_SERVER_ISSUER_URL'),
+        clientId: env.required('IDENTITY_SERVER_CLIENT_ID'),
+        secret: env.required('IDENTITY_SERVER_CLIENT_SECRET'),
+        scopes: env.requiredJSON('IDENTITY_SERVER_CLIENT_SCOPES'),
+      },
+      allowedRedirectUris: env.requiredJSON('BFF_ALLOWED_REDIRECT_URIS'),
+      callbacksRedirectUris: {
+        login: `${callbacksBaseRedirectPath}/login`,
+        logout: `${callbacksBaseRedirectPath}/logout`,
+      },
+      /**
+       * The base64 encoded secret used for encrypting and decrypting.
+       */
+      tokenSecretBase64: env.required('BFF_TOKEN_SECRET_BASE64'),
+      /**
+       * Allowed external API URLs that the BFF can proxy requests to
+       */
+      allowedExternalApiUrls: env.requiredJSON(
+        'BFF_ALLOWED_EXTERNAL_API_URLS',
+        [
+          // Download service local endpoint
+          'http://localhost:3377/download/v1/*',
+        ],
+      ),
+      /**
+       * Time-to-live (TTL) in milliseconds for caching.
+       */
+      cacheUserProfileTTLms: env.requiredJSON('BFF_CACHE_USER_PROFILE_TTL_MS'),
+      cacheLoginAttemptTTLms: env.requiredJSON('BFF_LOGIN_ATTEMPT_TTL_MS'),
+    }
+  },
+})
diff --git a/apps/services/bff/src/app/constants/cookies.ts b/apps/services/bff/src/app/constants/cookies.ts
new file mode 100644
index 000000000000..51f8292b554f
--- /dev/null
+++ b/apps/services/bff/src/app/constants/cookies.ts
@@ -0,0 +1 @@
+export const SESSION_COOKIE_NAME = 'sid'
diff --git a/apps/services/bff/src/app/constants/time.ts b/apps/services/bff/src/app/constants/time.ts
new file mode 100644
index 000000000000..6ed98a5e9b64
--- /dev/null
+++ b/apps/services/bff/src/app/constants/time.ts
@@ -0,0 +1 @@
+export const FIVE_SECONDS_IN_MS = 5 * 1000
diff --git a/apps/services/bff/src/app/modules/auth/auth.controller.spec.ts b/apps/services/bff/src/app/modules/auth/auth.controller.spec.ts
new file mode 100644
index 000000000000..ac2b1d951a9d
--- /dev/null
+++ b/apps/services/bff/src/app/modules/auth/auth.controller.spec.ts
@@ -0,0 +1,539 @@
+import { ConfigType } from '@island.is/nest/config'
+import { CACHE_MANAGER } from '@nestjs/cache-manager'
+import { HttpStatus, INestApplication } from '@nestjs/common'
+import jwt from 'jsonwebtoken'
+import request from 'supertest'
+import { setupTestServer } from '../../../../test/setupTestServer'
+import {
+  mockedTokensResponse as tokensResponse,
+  SID_VALUE,
+  SESSION_COOKIE_NAME,
+  ALGORITM_TYPE,
+  getLoginSearchParmsFn,
+} from '../../../../test/sharedConstants'
+import { BffConfig } from '../../bff.config'
+import { IdsService } from '../ids/ids.service'
+import { ParResponse } from '../ids/ids.types'
+
+const KID = 'test-kid'
+const SECRET_KEY = 'mock_secret'
+
+jest.mock('uuid', () => ({
+  v4: jest.fn().mockReturnValue('fake_uuid'),
+}))
+
+const validSigningKey = {
+  kid: KID,
+  alg: ALGORITM_TYPE,
+  getPublicKey: jest.fn().mockReturnValue(SECRET_KEY),
+}
+
+const noMatchKidSigningKey = {
+  kid: 'invalid-kid',
+  alg: ALGORITM_TYPE,
+  getPublicKey: jest.fn().mockReturnValue(SECRET_KEY),
+}
+
+const mockedSigningKeys = jest.fn().mockReturnValue([validSigningKey])
+
+jest.mock('jwks-rsa', () => {
+  return jest.fn().mockImplementation(() => ({
+    getSigningKeys: mockedSigningKeys,
+  }))
+})
+
+const mockCacheStore = new Map()
+
+const mockCacheManagerValue = {
+  set: jest.fn((key, value) => mockCacheStore.set(key, value)),
+  get: jest.fn((key) => mockCacheStore.get(key)),
+  del: jest.fn((key) => mockCacheStore.delete(key)),
+}
+
+const parResponse: ParResponse = {
+  request_uri: 'urn:ietf:params:oauth:request_uri:abc123',
+  expires_in: 600,
+}
+
+const allowedTargetLinkUri = 'http://test-client.com/testclient'
+
+const mockIdsService = {
+  getPar: jest.fn().mockResolvedValue({
+    type: 'success',
+    data: parResponse,
+  }),
+  getTokens: jest.fn().mockResolvedValue({
+    type: 'success',
+    data: tokensResponse,
+  }),
+  revokeToken: jest.fn().mockResolvedValue({
+    type: 'success',
+  }),
+  getLoginSearchParams: jest.fn().mockImplementation(getLoginSearchParmsFn),
+}
+
+describe('AuthController', () => {
+  let app: INestApplication
+  let server: request.SuperTest<request.Test>
+  let mockConfig: ConfigType<typeof BffConfig>
+  let baseUrlWithKey: string
+
+  beforeAll(async () => {
+    const app = await setupTestServer({
+      override: (builder) =>
+        builder
+          .overrideProvider(CACHE_MANAGER)
+          .useValue(mockCacheManagerValue)
+          .overrideProvider(IdsService)
+          .useValue(mockIdsService),
+    })
+
+    mockConfig = app.get<ConfigType<typeof BffConfig>>(BffConfig.KEY)
+    baseUrlWithKey = `${mockConfig.clientBaseUrl}${process.env.BFF_CLIENT_KEY_PATH}`
+
+    server = request(app.getHttpServer())
+  })
+
+  afterEach(() => {
+    mockCacheStore.clear()
+    jest.clearAllMocks()
+  })
+
+  afterAll(async () => {
+    if (app) {
+      await app.close()
+    }
+  })
+
+  describe('GET /login', () => {
+    it('should cache the login attempt', async () => {
+      // Arrange
+      const setSpy = jest.spyOn(mockCacheManagerValue, 'set')
+
+      // Act
+      const res = await server
+        .get('/login')
+        .query({ target_link_uri: allowedTargetLinkUri })
+
+      // Assert
+      expect(res.status).toEqual(HttpStatus.FOUND)
+      expect(setSpy).toHaveBeenCalled()
+
+      const [key, value] = setSpy.mock.calls[0]
+
+      expect(key).toEqual(`attempt_${SID_VALUE}`)
+      expect(value).toMatchObject({
+        originUrl: baseUrlWithKey,
+        codeVerifier: expect.any(String),
+        targetLinkUri: allowedTargetLinkUri,
+      })
+    })
+
+    it('should call login endpoint with correct parameters', async () => {
+      // Arrange
+      const expectedParams = {
+        client_id: mockConfig.ids.clientId,
+        response_type: 'code',
+        response_mode: 'query',
+        scope: 'test_scope offline_access openid profile',
+        redirect_uri: mockConfig.callbacksRedirectUris.login,
+        code_challenge_method: 'test_code_challenge_method',
+      }
+
+      const unknownValueParams = ['state', 'code_challenge']
+
+      // Act
+      const res = await server.get('/login')
+
+      // Assert
+      expect(res.status).toEqual(HttpStatus.FOUND)
+
+      // Check if the location header starts with the issuer ID
+      expect(res.headers.location).toMatch(
+        new RegExp(`^${mockConfig.ids.issuer}?`),
+      )
+
+      const url = new URL(res.headers.location)
+
+      // Verify that each expected parameter is present
+      for (const [key, value] of Object.entries(expectedParams)) {
+        if (key === 'scope') {
+          for (const scope of value.split(' ')) {
+            expect(url.searchParams.get('scope')).toContain(scope)
+          }
+        } else {
+          expect(url.searchParams.get(key)).toEqual(value)
+        }
+      }
+
+      // Verify that each unknown value parameter is present
+      for (const key of unknownValueParams) {
+        expect(url.searchParams.get(key)).toBeDefined()
+      }
+    })
+
+    it('should validate the query string param "target_link_uri" if not allowed', async () => {
+      // Arrange
+      const invalidTargetLinkUri = 'http://test-client.com/invalid'
+
+      const searchParams = new URLSearchParams({
+        bff_error_code: '400',
+        bff_error_description: 'Login failed!',
+      })
+
+      const errorUrl = `${baseUrlWithKey}?${searchParams.toString()}`
+
+      // Act
+      const res = await server
+        .get('/login')
+        .query({ target_link_uri: invalidTargetLinkUri })
+
+      // Assert
+      expect(res.status).toEqual(HttpStatus.FOUND)
+      expect(res.headers.location).toMatch(errorUrl)
+    })
+
+    it('should validate the query string param "target_link_uri" if allowed', async () => {
+      // Act
+      const res = await server
+        .get('/login')
+        .query({ target_link_uri: allowedTargetLinkUri })
+
+      // Assert
+      expect(res.status).toEqual(HttpStatus.FOUND)
+      expect(res.headers.location).toMatch(
+        new RegExp(`^${mockConfig.ids.issuer}?`),
+      )
+    })
+
+    it('should support PAR (Pushed Authorization Request) when enabled in config', async () => {
+      // Arrange
+      const parResponse: ParResponse = {
+        request_uri: 'urn:ietf:params:oauth:request_uri:abc123',
+        expires_in: 600,
+      }
+
+      const expectedParams = {
+        request_uri: parResponse.request_uri,
+        client_id: mockConfig.ids.clientId,
+      }
+
+      const redirectUrlSearchParams = new URLSearchParams(expectedParams)
+
+      const app = await setupTestServer({
+        override: (builder) =>
+          builder
+            .overrideProvider(IdsService)
+            .useValue(mockIdsService)
+            .overrideProvider(BffConfig.KEY)
+            .useValue({
+              ...mockConfig,
+              parSupportEnabled: true,
+            }),
+      })
+
+      const newServer = request(app.getHttpServer())
+      const getParSpy = jest.spyOn(mockIdsService, 'getPar')
+
+      // Act
+      const res = await newServer.get('/login')
+
+      // Assert
+      expect(getParSpy).toHaveBeenCalled()
+      expect(res.status).toEqual(HttpStatus.FOUND)
+      expect(res.headers.location).toEqual(
+        `${
+          mockConfig.ids.issuer
+        }/connect/authorize?${redirectUrlSearchParams.toString()}`,
+      )
+    })
+  })
+
+  describe('GET /callbacks/login', () => {
+    it('should redirect with error if invalid_request is present', async () => {
+      // Arrange
+      const idsError = 'Invalid request'
+      const searchParams = new URLSearchParams({
+        bff_error_code: '500',
+        bff_error_description: idsError,
+      })
+
+      const errorUrl = `${baseUrlWithKey}?${searchParams.toString()}`
+
+      // Act
+      const res = await server.get('/callbacks/login').query({
+        invalid_request: idsError,
+      })
+
+      // Assert
+      expect(res.status).toEqual(HttpStatus.FOUND)
+      expect(res.headers.location).toMatch(errorUrl)
+    })
+
+    it('should validate query string params and redirect with error if invalid', async () => {
+      // Arrange
+      const searchParams = new URLSearchParams({
+        bff_error_code: '400',
+        bff_error_description: 'Login failed!',
+      })
+      const errorUrl = `${baseUrlWithKey}?${searchParams.toString()}`
+
+      // Act
+      const res = await server.get('/callbacks/login')
+
+      // Assert
+      expect(res.status).toEqual(HttpStatus.FOUND)
+      expect(res.headers.location).toMatch(errorUrl)
+    })
+
+    const scenarios = [
+      {
+        description:
+          'should successfully finish callback login and redirect to fallback originUrl',
+        targetLinkUri: undefined,
+        expectedLocation: 'http://test-client.com/testclient',
+      },
+      {
+        description:
+          'should successfully finish callback login and redirect to target_link_uri query param',
+        targetLinkUri: allowedTargetLinkUri,
+        expectedLocation: allowedTargetLinkUri,
+      },
+    ]
+
+    it.each(scenarios)(
+      '$description',
+      async ({ targetLinkUri, expectedLocation }) => {
+        // Arrange
+        const code = 'testcode'
+        const getTokensSpy = jest.spyOn(mockIdsService, 'getTokens')
+        const deleteCacheSpy = jest.spyOn(mockCacheManagerValue, 'del')
+        const setCacheSpy = jest.spyOn(mockCacheManagerValue, 'set')
+        const getCacheSpy = jest.spyOn(mockCacheManagerValue, 'get')
+
+        // Act - First request to cache the login attempt
+        await server
+          .get('/login')
+          .query(targetLinkUri ? { target_link_uri: targetLinkUri } : {})
+
+        const loginAttempt = setCacheSpy.mock.calls[0]
+
+        // Assert - First request should cache the login attempt
+        expect(setCacheSpy.mock.calls[0]).toContain(`attempt_${SID_VALUE}`)
+        expect(loginAttempt[1]).toMatchObject({
+          originUrl: baseUrlWithKey,
+          codeVerifier: expect.any(String),
+          targetLinkUri,
+        })
+
+        // Then make a callback to the login endpoint
+        const res = await server
+          .get('/callbacks/login')
+          .set('Cookie', [`${SESSION_COOKIE_NAME}=${SID_VALUE}`])
+          .query({ code, state: SID_VALUE })
+
+        const currentLogin = setCacheSpy.mock.calls[1]
+
+        // Assert
+        expect(setCacheSpy).toHaveBeenCalled()
+
+        expect(currentLogin[0]).toContain(`current_${SID_VALUE}`)
+        // Check if the cache contains the correct values for the current login
+        expect(currentLogin[1]).toMatchObject(tokensResponse)
+
+        expect(getCacheSpy).toHaveBeenCalled()
+        expect(getTokensSpy).toHaveBeenCalled()
+        expect(deleteCacheSpy).toHaveBeenCalled()
+
+        expect(res.status).toEqual(HttpStatus.FOUND)
+
+        // Should redirect to the expected location
+        expect(res.headers.location).toEqual(expectedLocation)
+      },
+    )
+  })
+
+  describe('GET /logout', () => {
+    it('should throw bad request if no sid query string is found', async () => {
+      // Act
+      await server
+        .get('/login')
+        .query({ target_link_uri: allowedTargetLinkUri })
+
+      await server
+        .get('/callbacks/login')
+        .set('Cookie', [`${SESSION_COOKIE_NAME}=${SID_VALUE}`])
+        .query({ code: 'some_code', state: SID_VALUE })
+      const res = await server.get('/logout')
+
+      // Assert
+      expect(res.status).toEqual(HttpStatus.BAD_REQUEST)
+    })
+
+    it('should validate if no session cookie is found', async () => {
+      // Act
+      const res = await server.get('/logout').query({ sid: SID_VALUE })
+
+      // Assert
+      expect(res.status).toEqual(HttpStatus.FOUND)
+      expect(res.headers.location).toEqual(mockConfig.logoutRedirectUri)
+    })
+
+    it('should redirect to logout redirect uri with error params if cookie and session state do not match', async () => {
+      // Arrange
+      const searchParams = new URLSearchParams({
+        bff_error_code: '400',
+        bff_error_description: 'Logout failed!',
+      })
+
+      const errorUrl = `${allowedTargetLinkUri}?${searchParams.toString()}`
+
+      // Act
+      const res = await server
+        .get('/logout')
+        .query({ sid: SID_VALUE })
+        .set('Cookie', [`${SESSION_COOKIE_NAME}=invalid_uuid`])
+
+      // Assert
+      expect(res.status).toEqual(HttpStatus.FOUND)
+      expect(res.headers.location).toMatch(errorUrl)
+    })
+
+    it('should successfully logout and redirect to logout redirect uri', async () => {
+      // Arrange
+      const deleteCacheSpy = jest.spyOn(mockCacheManagerValue, 'del')
+      const revokeRefreshTokenSpy = jest.spyOn(mockIdsService, 'revokeToken')
+      const searchParams = new URLSearchParams({
+        id_token_hint: tokensResponse.id_token,
+        post_logout_redirect_uri: mockConfig.logoutRedirectUri,
+      })
+
+      // Act
+      await server
+        .get('/login')
+        .query({ target_link_uri: allowedTargetLinkUri })
+
+      await server
+        .get('/callbacks/login')
+        .set('Cookie', [`${SESSION_COOKIE_NAME}=${SID_VALUE}`])
+        .query({ code: 'some_code', state: SID_VALUE })
+
+      const res = await server
+        .get('/logout')
+        .query({ sid: SID_VALUE })
+        .set('Cookie', [`${SESSION_COOKIE_NAME}=${SID_VALUE}`])
+
+      // Assert
+      expect(revokeRefreshTokenSpy).toHaveBeenCalled()
+      expect(deleteCacheSpy).toHaveBeenCalled()
+      expect(res.status).toEqual(HttpStatus.FOUND)
+
+      expect(res.headers.location).toEqual(
+        `${
+          mockConfig.ids.issuer
+        }/connect/endsession?${searchParams.toString()}`,
+      )
+    })
+  })
+
+  describe('POST /callbacks/logout', () => {
+    let tokenPayload: object
+
+    beforeAll(() => {
+      tokenPayload = {
+        iss: mockConfig.ids.issuer,
+        sub: '1234567890',
+        exp: Math.floor(Date.now() / 1000) + 3600,
+        sid: SID_VALUE,
+      }
+    })
+
+    it('should throw 400 if logout_token is missing from body', async () => {
+      // Act
+      const res = await await server.post('/callbacks/logout')
+
+      // Assert
+      expect(res.status).toEqual(HttpStatus.BAD_REQUEST)
+      // Expect error to be
+      expect(res.body).toMatchObject({
+        statusCode: 400,
+        message: 'No param "logout_token" provided!',
+      })
+    })
+
+    it('should throw an error for a invalid logout_token, no matching key found for kid', async () => {
+      // Arrange
+      mockedSigningKeys.mockImplementationOnce(() => [noMatchKidSigningKey])
+
+      const invalidToken = jwt.sign(tokenPayload, SECRET_KEY, {
+        algorithm: ALGORITM_TYPE,
+        header: { kid: KID },
+      })
+
+      // Act
+      const res = await server
+        .post('/callbacks/logout')
+        .send({ logout_token: invalidToken })
+
+      // Assert
+      expect(res.status).toEqual(HttpStatus.UNAUTHORIZED)
+    })
+
+    it('should throw an error for a invalid logout_token, no sid in the token', async () => {
+      // Arrange
+      const invalidToken = jwt.sign(
+        {
+          ...tokenPayload,
+          sid: undefined,
+        },
+        SECRET_KEY,
+        {
+          algorithm: ALGORITM_TYPE,
+          header: { kid: KID },
+        },
+      )
+
+      // Act
+      const res = await server
+        .post('/callbacks/logout')
+        .send({ logout_token: invalidToken })
+
+      // Assert
+      expect(res.status).toEqual(HttpStatus.UNAUTHORIZED)
+    })
+
+    it('should return a 200 success response', async () => {
+      // Arrange
+      const validToken = jwt.sign(tokenPayload, SECRET_KEY, {
+        algorithm: ALGORITM_TYPE,
+        header: { kid: KID },
+      })
+
+      const getCacheSpy = jest.spyOn(mockCacheManagerValue, 'get')
+      const revokeRefreshTokenSpy = jest.spyOn(mockIdsService, 'revokeToken')
+
+      // Act
+      await server
+        .get('/login')
+        .query({ target_link_uri: allowedTargetLinkUri })
+
+      await server
+        .get('/callbacks/login')
+        .set('Cookie', [`${SESSION_COOKIE_NAME}=${SID_VALUE}`])
+        .query({ code: 'some_code', state: SID_VALUE })
+
+      const res = await server
+        .post('/callbacks/logout')
+        .send({ logout_token: validToken })
+
+      // Assert
+      expect(getCacheSpy).toHaveBeenCalled()
+      expect(revokeRefreshTokenSpy).toHaveBeenCalled()
+      expect(res.status).toEqual(HttpStatus.OK)
+      expect(res.body).toMatchObject({
+        status: 'success',
+        message: 'Logout successful!',
+      })
+    })
+  })
+})
diff --git a/apps/services/bff/src/app/modules/auth/auth.controller.ts b/apps/services/bff/src/app/modules/auth/auth.controller.ts
new file mode 100644
index 000000000000..4ea72c95a879
--- /dev/null
+++ b/apps/services/bff/src/app/modules/auth/auth.controller.ts
@@ -0,0 +1,66 @@
+import {
+  Body,
+  Controller,
+  Get,
+  Post,
+  Query,
+  Req,
+  Res,
+  VERSION_NEUTRAL,
+} from '@nestjs/common'
+import { Request, Response } from 'express'
+import { qsValidationPipe } from '../../utils/qs-validation-pipe'
+import { AuthService } from './auth.service'
+import { CallbackLoginDto } from './dto/callback-login.dto'
+import { CallbackLogoutDto } from './dto/callback-logout.dto'
+import { LoginDto } from './dto/login.dto'
+import { LogoutDto } from './dto/logout.dto'
+
+@Controller({
+  version: [VERSION_NEUTRAL, '1'],
+})
+export class AuthController {
+  constructor(private authService: AuthService) {}
+
+  @Get('login')
+  async login(
+    @Res() res: Response,
+    @Query(qsValidationPipe)
+    query: LoginDto,
+  ): Promise<void> {
+    return this.authService.login({ res, query })
+  }
+
+  @Get('callbacks/login')
+  async callbackLogin(
+    @Req() req: Request,
+    @Res() res: Response,
+    @Query(qsValidationPipe)
+    query: CallbackLoginDto,
+  ): Promise<void> {
+    return this.authService.callbackLogin({ req, res, query })
+  }
+
+  @Get('logout')
+  async logout(
+    @Req() req: Request,
+    @Res() res: Response,
+    @Query(qsValidationPipe)
+    query: LogoutDto,
+  ): Promise<void> {
+    return this.authService.logout({ req, res, query })
+  }
+
+  @Post('callbacks/logout')
+  async callbackBackchannelLogout(
+    @Res() res: Response,
+    @Body() body: CallbackLogoutDto,
+  ): Promise<
+    Response<{
+      status: string
+      message: string
+    }>
+  > {
+    return this.authService.callbackLogout(res, body)
+  }
+}
diff --git a/apps/services/bff/src/app/modules/auth/auth.module.ts b/apps/services/bff/src/app/modules/auth/auth.module.ts
new file mode 100644
index 000000000000..9785e7063252
--- /dev/null
+++ b/apps/services/bff/src/app/modules/auth/auth.module.ts
@@ -0,0 +1,13 @@
+import { Module } from '@nestjs/common'
+import { IdsService } from '../ids/ids.service'
+import { AuthController } from './auth.controller'
+import { AuthService } from './auth.service'
+import { PKCEService } from '../../services/pkce.service'
+import { CryptoService } from '../../services/crypto.service'
+
+@Module({
+  controllers: [AuthController],
+  providers: [AuthService, PKCEService, IdsService, CryptoService],
+  exports: [AuthService],
+})
+export class AuthModule {}
diff --git a/apps/services/bff/src/app/modules/auth/auth.service.ts b/apps/services/bff/src/app/modules/auth/auth.service.ts
new file mode 100644
index 000000000000..f9e0d6008d42
--- /dev/null
+++ b/apps/services/bff/src/app/modules/auth/auth.service.ts
@@ -0,0 +1,545 @@
+import type { Logger } from '@island.is/logging'
+import { LOGGER_PROVIDER } from '@island.is/logging'
+import {
+  BadRequestException,
+  HttpStatus,
+  Inject,
+  Injectable,
+  InternalServerErrorException,
+  UnauthorizedException,
+} from '@nestjs/common'
+import { ConfigType } from '@nestjs/config'
+import { CookieOptions, Request, Response } from 'express'
+import jwksClient from 'jwks-rsa'
+import { jwtDecode } from 'jwt-decode'
+
+import { IdTokenClaims } from '@island.is/shared/types'
+import { decode, verify, Algorithm } from 'jsonwebtoken'
+import { v4 as uuid } from 'uuid'
+import { environment } from '../../../environment'
+import { BffConfig } from '../../bff.config'
+import { SESSION_COOKIE_NAME } from '../../constants/cookies'
+import { FIVE_SECONDS_IN_MS } from '../../constants/time'
+import { CryptoService } from '../../services/crypto.service'
+import { PKCEService } from '../../services/pkce.service'
+import {
+  CreateErrorQueryStrArgs,
+  createErrorQueryStr,
+} from '../../utils/create-error-query-str'
+import { validateUri } from '../../utils/validate-uri'
+import { CacheService } from '../cache/cache.service'
+import { IdsService } from '../ids/ids.service'
+import { LogoutTokenPayload, TokenResponse } from '../ids/ids.types'
+import { CachedTokenResponse } from './auth.types'
+import { CallbackLoginDto } from './dto/callback-login.dto'
+import { CallbackLogoutDto } from './dto/callback-logout.dto'
+import { LoginDto } from './dto/login.dto'
+import { LogoutDto } from './dto/logout.dto'
+
+@Injectable()
+export class AuthService {
+  private readonly baseUrl
+
+  constructor(
+    @Inject(LOGGER_PROVIDER)
+    private logger: Logger,
+
+    @Inject(BffConfig.KEY)
+    private readonly config: ConfigType<typeof BffConfig>,
+
+    private readonly pkceService: PKCEService,
+    private readonly cacheService: CacheService,
+    private readonly idsService: IdsService,
+    private readonly cryptoService: CryptoService,
+  ) {
+    this.baseUrl = this.config.ids.issuer
+  }
+
+  private getCookieOptions(): CookieOptions {
+    return {
+      httpOnly: true,
+      secure: true,
+      // The lax setting allows cookies to be sent on top-level navigations (such as redirects),
+      // while still providing some protection against CSRF attacks.
+      sameSite: 'lax',
+      path: environment.keyPath,
+    }
+  }
+
+  /**
+   * Creates the client base URL with the path appended.
+   */
+  private createClientBaseUrl() {
+    const baseUrl = new URL(this.config.clientBaseUrl)
+    baseUrl.pathname = `${baseUrl.pathname}${environment.keyPath}`
+      // Prevent potential issues with malformed URLs.
+      .replace('//', '/')
+
+    return baseUrl.toString()
+  }
+
+  /**
+   * Redirects the user to the client base URL with an error query string.
+   */
+  private createClientBaseUrlWithError(args: CreateErrorQueryStrArgs) {
+    return `${this.createClientBaseUrl()}?${createErrorQueryStr(args)}`
+  }
+
+  /**
+   * Redirects the user to the client base URL with an error query string.
+   */
+  private redirectWithError(
+    res: Response,
+    args?: Partial<CreateErrorQueryStrArgs>,
+  ) {
+    const code = args?.code || 500
+    const error = args?.error || 'Login failed!'
+
+    return res.redirect(this.createClientBaseUrlWithError({ code, error }))
+  }
+
+  /**
+   * Formats and updates the token cache with new token response data.
+   */
+  public async updateTokenCache(
+    tokenResponse: TokenResponse,
+  ): Promise<CachedTokenResponse> {
+    const userProfile: IdTokenClaims = jwtDecode(tokenResponse.id_token)
+
+    const value: CachedTokenResponse = {
+      ...tokenResponse,
+      // Encrypt the access and refresh tokens before saving them to the cache
+      // to prevent unauthorized access to the tokens if cached service is compromised.
+      encryptedAccessToken: this.cryptoService.encrypt(
+        tokenResponse.access_token,
+      ),
+      encryptedRefreshToken: this.cryptoService.encrypt(
+        tokenResponse.refresh_token,
+      ),
+      scopes: tokenResponse.scope.split(' '),
+      userProfile,
+      // Subtract 5 seconds from the token expiration time to account for latency.
+      accessTokenExp:
+        Date.now() + (tokenResponse.expires_in * 1000 - FIVE_SECONDS_IN_MS),
+    }
+
+    // Save the tokenResponse to the cache
+    await this.cacheService.save({
+      key: this.cacheService.createSessionKeyType('current', userProfile.sid),
+      value,
+      ttl: this.config.cacheUserProfileTTLms,
+    })
+
+    return value
+  }
+
+  /**
+   * Revoke the refresh token on the identity server, since we have a new session.
+   * We deliberately do not await this operation to make the login flow faster,
+   * since this operation is not critical part to await.
+   * We use .catch() to handle unhandled promise rejections.
+   *
+   * @param encryptedRefreshToken The encrypted refresh token to revoke
+   */
+  private revokeRefreshToken(encryptedRefreshToken: string) {
+    this.idsService
+      .revokeToken(encryptedRefreshToken, 'refresh_token')
+      .catch((error) => {
+        this.logger.warn('Failed to revoke refresh token:', error)
+      })
+  }
+
+  /**
+   * This method initiates the login flow.
+   * It validates the target_link_uri and generates a unique session id, for a login attempt.
+   * It also generates a code verifier and code challenge to enhance security.
+   * The login attempt data is saved in the cache and a PAR request is made to the identity server.
+   * The user is then redirected to the identity server login page.
+   */
+  async login({
+    res,
+    query: { target_link_uri: targetLinkUri, login_hint: loginHint, prompt },
+  }: {
+    res: Response
+    query: LoginDto
+  }) {
+    // Validate targetLinkUri if it is provided
+    if (
+      targetLinkUri &&
+      !validateUri(targetLinkUri, this.config.allowedRedirectUris)
+    ) {
+      this.logger.error(
+        `Invalid target_link_uri provided: ${targetLinkUri}. Allowed redirect uris: "${this.config.allowedRedirectUris.join(
+          ', ',
+        )}"`,
+      )
+
+      return this.redirectWithError(res, {
+        code: 400,
+      })
+    }
+
+    try {
+      // Generate a unique session id to be used as a login attempt,
+      // e.g. to store data in the cache with key 'attempt_sid' to be used in the callback login.
+      const attemptLoginId = uuid()
+
+      // Generate a code verifier and code challenge to enhance security
+      const codeVerifier = await this.pkceService.generateCodeVerifier()
+      const codeChallenge = await this.pkceService.generateCodeChallenge(
+        codeVerifier,
+      )
+
+      await this.cacheService.save({
+        key: this.cacheService.createSessionKeyType('attempt', attemptLoginId),
+        value: {
+          // Fallback if targetLinkUri is not provided
+          originUrl: this.createClientBaseUrl(),
+          // Code verifier to be used in the callback
+          codeVerifier,
+          targetLinkUri,
+        },
+        ttl: this.config.cacheLoginAttemptTTLms,
+      })
+
+      let searchParams: URLSearchParams
+
+      if (this.config.parSupportEnabled) {
+        const parResponse = await this.idsService.getPar({
+          sid: attemptLoginId,
+          codeChallenge,
+          loginHint,
+          prompt,
+        })
+
+        if (parResponse.type === 'error') {
+          throw parResponse.data
+        }
+
+        searchParams = new URLSearchParams({
+          request_uri: parResponse.data.request_uri,
+          client_id: this.config.ids.clientId,
+        })
+      } else {
+        searchParams = new URLSearchParams(
+          this.idsService.getLoginSearchParams({
+            sid: attemptLoginId,
+            codeChallenge,
+            loginHint,
+            prompt,
+          }),
+        )
+      }
+
+      return res.redirect(
+        `${this.baseUrl}/connect/authorize?${searchParams.toString()}`,
+      )
+    } catch (error) {
+      this.logger.error('Login failed: ', error)
+
+      return this.redirectWithError(res)
+    }
+  }
+
+  /**
+   * Callback for the login flow
+   * This method is called from the identity server after the user has logged in
+   * and the authorization code has been issued.
+   * The authorization code is then exchanged for tokens.
+   * We save the tokens and user information in the cache and create a session cookie.
+   * We also clean up cache keys not being used anymore.
+   * Finally, we redirect the user back to the original URL.
+   */
+  async callbackLogin({
+    req,
+    res,
+    query,
+  }: {
+    req: Request
+    res: Response
+    query: CallbackLoginDto
+  }) {
+    const idsError = query.invalid_request
+
+    // IDS might respond with an error if the request is missing a required parameter.
+    if (idsError) {
+      this.logger.error('Callback login IDS invalid request: ', idsError)
+
+      return this.redirectWithError(res, {
+        code: 500,
+        error: idsError,
+      })
+    }
+
+    // Validate query params
+    if (!query.code || !query.state) {
+      const missingParam = !query.code ? 'code' : 'state'
+      this.logger.error(
+        `Callback login failed: No query param "${missingParam}" provided.`,
+      )
+
+      return this.redirectWithError(res, {
+        code: 400,
+      })
+    }
+
+    try {
+      // Get login attempt from cache
+      const loginAttemptData = await this.cacheService.get<{
+        targetLinkUri?: string
+        codeVerifier: string
+        originUrl: string
+      }>(this.cacheService.createSessionKeyType('attempt', query.state))
+
+      // Get tokens and user information from the authorization code
+      const tokenResponse = await this.idsService.getTokens({
+        code: query.code,
+        codeVerifier: loginAttemptData.codeVerifier,
+      })
+
+      if (tokenResponse.type === 'error') {
+        throw tokenResponse.data
+      }
+
+      const updatedTokenResponse = await this.updateTokenCache(
+        tokenResponse.data,
+      )
+
+      // Clean up the login attempt from the cache since we have a successful login.
+      this.cacheService
+        .delete(this.cacheService.createSessionKeyType('attempt', query.state))
+        .catch((err) => {
+          this.logger.warn(err)
+        })
+
+      // Create session cookie with successful login session id
+      res.cookie(
+        SESSION_COOKIE_NAME,
+        updatedTokenResponse.userProfile.sid,
+        this.getCookieOptions(),
+      )
+
+      // Check if there is an old session cookie and clean up the cache
+      const oldSessionCookie = req.cookies[SESSION_COOKIE_NAME]
+
+      if (
+        oldSessionCookie &&
+        oldSessionCookie !== updatedTokenResponse.userProfile.sid
+      ) {
+        const oldSessionCacheKey = this.cacheService.createSessionKeyType(
+          'current',
+          oldSessionCookie,
+        )
+
+        const oldSessionData = await this.cacheService.get<CachedTokenResponse>(
+          oldSessionCacheKey,
+          // Do not throw an error if the key is not found
+          false,
+        )
+
+        if (oldSessionData) {
+          // Revoke the old session refresh token
+          this.revokeRefreshToken(oldSessionData.encryptedRefreshToken)
+
+          // Clean up the old session key from the cache.
+          // Use catch() to handle unhandled promise rejections
+          this.cacheService.delete(oldSessionCacheKey).catch((err) => {
+            this.logger.warn(err)
+          })
+        }
+      }
+
+      return res.redirect(
+        loginAttemptData.targetLinkUri || loginAttemptData.originUrl,
+      )
+    } catch (error) {
+      this.logger.error('Callback login failed: ', error)
+
+      return this.redirectWithError(res)
+    }
+  }
+
+  /**
+   * This method handles user logout. What it does:
+   *
+   * - Validates the session id in the query param and the session cookie
+   * - Cleans up the cache and cookies
+   * - Revokes the current session refresh token
+   * - Redirects the user to the identity server end session endpoint
+   */
+  async logout({
+    req,
+    res,
+    query,
+  }: {
+    req: Request
+    res: Response
+    query: LogoutDto
+  }) {
+    const sidCookie = req.cookies[SESSION_COOKIE_NAME]
+
+    if (!sidCookie) {
+      this.logger.error('Logout failed: No session cookie found')
+
+      return res.redirect(this.config.logoutRedirectUri)
+    }
+
+    if (sidCookie !== query.sid) {
+      this.logger.error(
+        `Logout failed: Cookie sid "${sidCookie}" does not match the session id in query param "${query.sid}"`,
+      )
+
+      return this.redirectWithError(res, {
+        code: 400,
+        error: 'Logout failed!',
+      })
+    }
+
+    const currentLoginCacheKey = this.cacheService.createSessionKeyType(
+      'current',
+      query.sid,
+    )
+
+    const cachedTokenResponse =
+      await this.cacheService.get<CachedTokenResponse>(
+        currentLoginCacheKey,
+        // Do not throw an error if the key is not found
+        false,
+      )
+
+    if (!cachedTokenResponse) {
+      this.logger.error(
+        `Logout failed: ${this.cacheService.createKeyError(
+          currentLoginCacheKey,
+        )}`,
+      )
+
+      return res.redirect(this.config.logoutRedirectUri)
+    }
+
+    /**
+     * Clean up!
+     *
+     * - Revoke the refresh token on the identity server
+     * - Delete the current login from the cache
+     * - Clear the session cookie
+     */
+    res.clearCookie(SESSION_COOKIE_NAME, this.getCookieOptions())
+
+    this.cacheService
+      .delete(currentLoginCacheKey)
+      // handle unhandled promise rejections
+      .catch((err) => {
+        this.logger.warn(err)
+      })
+    // Note! We deliberately do not await this operation to make the logout flow faster.
+    this.revokeRefreshToken(cachedTokenResponse.encryptedRefreshToken)
+
+    const searchParams = new URLSearchParams({
+      id_token_hint: cachedTokenResponse.id_token,
+      post_logout_redirect_uri: this.config.logoutRedirectUri,
+    })
+
+    return res.redirect(
+      `${this.baseUrl}/connect/endsession?${searchParams.toString()}`,
+    )
+  }
+
+  async validateLogoutToken(logoutToken: string): Promise<LogoutTokenPayload> {
+    try {
+      const secretClient = jwksClient({
+        cache: true,
+        rateLimit: true,
+        jwksUri: `${this.config.ids.issuer}/.well-known/openid-configuration/jwks`,
+      })
+
+      // Decode the token without verifying the signature
+      const decodedToken = decode(logoutToken, { complete: true })
+      const kid = decodedToken?.header?.kid
+
+      if (!kid) {
+        throw new Error('Invalid token header. No kid found in header.')
+      }
+
+      const signingKeys = await secretClient.getSigningKeys()
+
+      // Find the the correct signing key matching the headers kid
+      const signingKey = signingKeys.find((sk) => sk.kid === kid)
+
+      if (!signingKey) {
+        throw new Error(`No matching key found for kid "${kid}"`)
+      }
+
+      const publicKey = signingKey.getPublicKey()
+
+      // Verify the signature
+      const payload = verify(logoutToken, publicKey, {
+        algorithms: [signingKey.alg as Algorithm],
+        issuer: this.config.ids.issuer,
+      }) as LogoutTokenPayload
+
+      if (!payload.sid) {
+        throw new Error('No sid in the token')
+      }
+
+      return payload
+    } catch (error) {
+      this.logger.error('Error validating logout token: ', error)
+
+      throw new UnauthorizedException()
+    }
+  }
+
+  async callbackLogout(res: Response, body: CallbackLogoutDto) {
+    const logoutToken = body.logout_token
+
+    this.logger.info('Callback backchannel logout initiated', {
+      logoutToken,
+    })
+
+    if (!logoutToken) {
+      const errorMessage = 'No param "logout_token" provided!'
+      this.logger.error(errorMessage)
+
+      throw new BadRequestException(errorMessage)
+    }
+
+    try {
+      // Validate the logout token and extract payload
+      const payload = await this.validateLogoutToken(logoutToken)
+
+      // Create cache key and retrieve cached token response
+      const cacheKey = this.cacheService.createSessionKeyType(
+        'current',
+        payload.sid,
+      )
+      const cachedTokenResponse =
+        await this.cacheService.get<CachedTokenResponse>(
+          cacheKey,
+          false, // Do not throw an error if the key is not found
+        )
+
+      // Revoke refresh token and delete cache entry
+      if (cachedTokenResponse) {
+        this.revokeRefreshToken(cachedTokenResponse.encryptedRefreshToken)
+      }
+
+      await this.cacheService.delete(cacheKey)
+
+      return res.status(HttpStatus.OK).json({
+        status: 'success',
+        message: 'Logout successful!',
+      })
+    } catch (error) {
+      // Check if error is an UnauthorizedException and just throw it,
+      // since it is already being logged in the validateLogoutToken method.
+      if (error instanceof UnauthorizedException) {
+        throw error
+      }
+
+      this.logger.error('Callback backchannel logout failed: ', error)
+
+      throw new InternalServerErrorException()
+    }
+  }
+}
diff --git a/apps/services/bff/src/app/modules/auth/auth.types.ts b/apps/services/bff/src/app/modules/auth/auth.types.ts
new file mode 100644
index 000000000000..e57e52298603
--- /dev/null
+++ b/apps/services/bff/src/app/modules/auth/auth.types.ts
@@ -0,0 +1,23 @@
+import { IdTokenClaims } from '@island.is/shared/types'
+
+import { TokenResponse } from '../ids/ids.types'
+
+export type CachedTokenResponse = Omit<
+  TokenResponse,
+  'refresh_token' | 'access_token'
+> & {
+  scopes: string[]
+
+  /**
+   * Decoded id token claims
+   */
+  userProfile: IdTokenClaims
+
+  /**
+   * Expiration time of the access token
+   */
+  accessTokenExp: number
+
+  encryptedAccessToken: string
+  encryptedRefreshToken: string
+}
diff --git a/apps/services/bff/src/app/modules/auth/dto/callback-login.dto.ts b/apps/services/bff/src/app/modules/auth/dto/callback-login.dto.ts
new file mode 100644
index 000000000000..f8a22df32ff2
--- /dev/null
+++ b/apps/services/bff/src/app/modules/auth/dto/callback-login.dto.ts
@@ -0,0 +1,25 @@
+import { IsOptional, IsString } from 'class-validator'
+
+export class CallbackLoginDto {
+  @IsOptional()
+  @IsString()
+  code?: string
+
+  @IsOptional()
+  @IsString()
+  scope?: string
+
+  @IsOptional()
+  @IsString()
+  state?: string
+
+  @IsOptional()
+  @IsString()
+  session_state?: string
+
+  // IDS responds with an error if the request is invalid
+  // @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2.1
+  @IsOptional()
+  @IsString()
+  invalid_request?: string
+}
diff --git a/apps/services/bff/src/app/modules/auth/dto/callback-logout.dto.ts b/apps/services/bff/src/app/modules/auth/dto/callback-logout.dto.ts
new file mode 100644
index 000000000000..129b96ba83e3
--- /dev/null
+++ b/apps/services/bff/src/app/modules/auth/dto/callback-logout.dto.ts
@@ -0,0 +1,7 @@
+import { IsOptional, IsString } from 'class-validator'
+
+export class CallbackLogoutDto {
+  @IsOptional()
+  @IsString()
+  logout_token?: string
+}
diff --git a/apps/services/bff/src/app/modules/auth/dto/login.dto.ts b/apps/services/bff/src/app/modules/auth/dto/login.dto.ts
new file mode 100644
index 000000000000..8132325aa029
--- /dev/null
+++ b/apps/services/bff/src/app/modules/auth/dto/login.dto.ts
@@ -0,0 +1,15 @@
+import { IsOptional, IsString } from 'class-validator'
+
+export class LoginDto {
+  @IsOptional()
+  @IsString()
+  target_link_uri?: string
+
+  @IsOptional()
+  @IsString()
+  login_hint?: string
+
+  @IsOptional()
+  @IsString()
+  prompt?: string
+}
diff --git a/apps/services/bff/src/app/modules/auth/dto/logout.dto.ts b/apps/services/bff/src/app/modules/auth/dto/logout.dto.ts
new file mode 100644
index 000000000000..0462aa69fe9a
--- /dev/null
+++ b/apps/services/bff/src/app/modules/auth/dto/logout.dto.ts
@@ -0,0 +1,6 @@
+import { IsString } from 'class-validator'
+
+export class LogoutDto {
+  @IsString()
+  sid!: string
+}
diff --git a/apps/services/bff/src/app/modules/cache/cache.module.ts b/apps/services/bff/src/app/modules/cache/cache.module.ts
new file mode 100644
index 000000000000..379db4ba8f83
--- /dev/null
+++ b/apps/services/bff/src/app/modules/cache/cache.module.ts
@@ -0,0 +1,38 @@
+import { createRedisCluster } from '@island.is/cache'
+import { CacheModule as NestCacheModule } from '@nestjs/cache-manager'
+import { DynamicModule, Global, Module } from '@nestjs/common'
+import { ConfigType } from '@nestjs/config'
+import { redisInsStore } from 'cache-manager-ioredis-yet'
+import { BffConfig } from '../../bff.config'
+import { CacheService } from './cache.service'
+
+@Global()
+@Module({})
+export class CacheModule {
+  static register(): DynamicModule {
+    const imports =
+      process.env.NODE_ENV === 'test'
+        ? [NestCacheModule.register()]
+        : [
+            NestCacheModule.registerAsync({
+              useFactory: ({ redis }: ConfigType<typeof BffConfig>) => {
+                const configHasRedis = redis.nodes.length > 0 && redis.name
+
+                return {
+                  store: configHasRedis
+                    ? redisInsStore(createRedisCluster(redis))
+                    : undefined,
+                }
+              },
+              inject: [BffConfig.KEY],
+            }),
+          ]
+
+    return {
+      module: CacheModule,
+      imports,
+      providers: [CacheService],
+      exports: [CacheService],
+    }
+  }
+}
diff --git a/apps/services/bff/src/app/modules/cache/cache.service.ts b/apps/services/bff/src/app/modules/cache/cache.service.ts
new file mode 100644
index 000000000000..9e2f1b246c3b
--- /dev/null
+++ b/apps/services/bff/src/app/modules/cache/cache.service.ts
@@ -0,0 +1,65 @@
+import { Inject, Injectable } from '@nestjs/common'
+import { Cache as CacheManager } from 'cache-manager'
+
+import { CACHE_MANAGER } from '@nestjs/cache-manager'
+
+@Injectable()
+export class CacheService {
+  constructor(
+    @Inject(CACHE_MANAGER)
+    private readonly cacheManager: CacheManager,
+  ) {}
+
+  public createKeyError(key: string) {
+    return `Cache key "${key}" not found.`
+  }
+
+  /**
+   * Creates s unique key with session id.
+   * Type is either 'attempt' or 'current'.
+   * `attempt` represents the login attempt.
+   * `current` represents the current login session.
+   */
+  public createSessionKeyType(type: 'attempt' | 'current', sid: string) {
+    return `${type}_${sid}`
+  }
+
+  public async save({
+    key,
+    value,
+    ttl,
+  }: {
+    key: string
+    value: unknown
+    // Time to live in milliseconds
+    ttl?: number
+  }): Promise<void> {
+    await this.cacheManager.set(key, value, ttl)
+  }
+
+  /**
+   * Gets a value from the cache.
+   *
+   * @param key The key to get the value for.
+   * @param throwError If true, throws an error if the key is not found.
+   *
+   * @returns cache value
+   */
+  public async get<Value>(key: string, throwError = true): Promise<Value> {
+    const value = await this.cacheManager.get(key)
+
+    if (!value && throwError) {
+      throw new Error(this.createKeyError(key))
+    }
+
+    return value as Value
+  }
+
+  public async delete(key: string) {
+    try {
+      await this.cacheManager.del(key)
+    } catch (error) {
+      throw new Error(`Failed to delete key "${key}" from cache.`)
+    }
+  }
+}
diff --git a/apps/services/bff/src/app/modules/enhancedFetch/enhanced-fetch.module.ts b/apps/services/bff/src/app/modules/enhancedFetch/enhanced-fetch.module.ts
new file mode 100644
index 000000000000..df6ef6c4c9fb
--- /dev/null
+++ b/apps/services/bff/src/app/modules/enhancedFetch/enhanced-fetch.module.ts
@@ -0,0 +1,9 @@
+import { Global, Module } from '@nestjs/common'
+import { EnhancedFetchProvider } from './enhanced-fetch.provider'
+
+@Global()
+@Module({
+  providers: [EnhancedFetchProvider],
+  exports: [EnhancedFetchProvider],
+})
+export class EnhancedFetchModule {}
diff --git a/apps/services/bff/src/app/modules/enhancedFetch/enhanced-fetch.provider.ts b/apps/services/bff/src/app/modules/enhancedFetch/enhanced-fetch.provider.ts
new file mode 100644
index 000000000000..d935844ff506
--- /dev/null
+++ b/apps/services/bff/src/app/modules/enhancedFetch/enhanced-fetch.provider.ts
@@ -0,0 +1,17 @@
+import { Provider } from '@nestjs/common'
+
+import {
+  createEnhancedFetch,
+  type EnhancedFetchAPI,
+} from '@island.is/clients/middlewares'
+import { environment } from '../../../environment'
+
+export const ENHANCED_FETCH_PROVIDER_KEY = 'enhanced-fetch-provider'
+
+export const EnhancedFetchProvider: Provider<EnhancedFetchAPI> = {
+  provide: ENHANCED_FETCH_PROVIDER_KEY,
+  useFactory: () =>
+    createEnhancedFetch({
+      name: `bff-${environment.name}-service`,
+    }),
+}
diff --git a/apps/services/bff/src/app/modules/ids/ids.service.ts b/apps/services/bff/src/app/modules/ids/ids.service.ts
new file mode 100644
index 000000000000..77b744598e88
--- /dev/null
+++ b/apps/services/bff/src/app/modules/ids/ids.service.ts
@@ -0,0 +1,202 @@
+import { Inject, Injectable } from '@nestjs/common'
+import { ConfigType } from '@nestjs/config'
+
+import type { EnhancedFetchAPI } from '@island.is/clients/middlewares'
+import { BffConfig } from '../../bff.config'
+import { CryptoService } from '../../services/crypto.service'
+import { ENHANCED_FETCH_PROVIDER_KEY } from '../enhancedFetch/enhanced-fetch.provider'
+import {
+  ApiResponse,
+  ErrorRes,
+  GetLoginSearchParamsReturnValue,
+  ParResponse,
+  TokenResponse,
+} from './ids.types'
+
+@Injectable()
+export class IdsService {
+  private readonly issuerUrl: string
+
+  constructor(
+    @Inject(BffConfig.KEY)
+    private readonly config: ConfigType<typeof BffConfig>,
+
+    @Inject(ENHANCED_FETCH_PROVIDER_KEY)
+    private readonly enhancedFetch: EnhancedFetchAPI,
+
+    private readonly cryptoService: CryptoService,
+  ) {
+    this.issuerUrl = this.config.ids.issuer
+  }
+
+  /**
+   * Reusable fetch fn to make POST requests
+   */
+  private async postRequest<T>(
+    endpoint: string,
+    body: Record<string, string>,
+  ): Promise<ApiResponse<T>> {
+    try {
+      const response = await this.enhancedFetch(
+        `${this.issuerUrl}${endpoint}`,
+        {
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/x-www-form-urlencoded',
+          },
+          body: new URLSearchParams(body).toString(),
+        },
+      )
+
+      const contentType = response.headers.get('content-type') || ''
+
+      if (contentType.includes('application/json')) {
+        const data = await response.json()
+
+        if (!response.ok) {
+          // If error response from Ids is not in the expected format, throw the data as is
+          if (!data.error || !data.error_description) {
+            throw data
+          }
+
+          return {
+            type: 'error',
+            data: {
+              error: data.error,
+              error_description: data.error_description,
+            },
+          } as ErrorRes
+        }
+
+        return {
+          type: 'success',
+          data: data as T,
+        }
+      }
+
+      // Handle plain text responses
+      const textResponse = await response.text()
+
+      if (!response.ok) {
+        throw textResponse
+      }
+
+      return {
+        type: 'success',
+        data: textResponse,
+      } as ApiResponse<T>
+    } catch (error) {
+      throw new Error(error)
+    }
+  }
+
+  public getLoginSearchParams({
+    sid,
+    codeChallenge,
+    loginHint,
+    prompt,
+  }: {
+    sid: string
+    codeChallenge: string
+    loginHint?: string
+    prompt?: string
+  }): GetLoginSearchParamsReturnValue {
+    const { ids } = this.config
+    return {
+      client_id: ids.clientId,
+      redirect_uri: this.config.callbacksRedirectUris.login,
+      response_type: 'code',
+      response_mode: 'query',
+      scope: [
+        'openid',
+        'profile',
+        // Allows us to get refresh tokens
+        'offline_access',
+        ...ids.scopes,
+      ].join(' '),
+      state: sid,
+      code_challenge: codeChallenge,
+      code_challenge_method: 'S256',
+      ...(loginHint && { login_hint: loginHint }),
+      ...(prompt && { prompt }),
+    }
+  }
+
+  /**
+   * Fetches the PAR (Pushed Authorization Requests) from the Ids
+   */
+  public async getPar(args: {
+    sid: string
+    codeChallenge: string
+    loginHint?: string
+    prompt?: string
+  }) {
+    return this.postRequest<ParResponse>('/connect/par', {
+      client_secret: this.config.ids.secret,
+      ...this.getLoginSearchParams(args),
+    })
+  }
+
+  /**
+   * Fetches the tokens from the Ids
+   *
+   * @param obj.code - The code from the Ids
+   * @param obj.codeVerifier - The code verifier from the Ids
+   */
+  public async getTokens({
+    code,
+    codeVerifier,
+  }: {
+    code: string
+    codeVerifier: string
+  }) {
+    const { ids } = this.config
+
+    return this.postRequest<TokenResponse>('/connect/token', {
+      grant_type: 'authorization_code',
+      code,
+      client_secret: ids.secret,
+      client_id: ids.clientId,
+      redirect_uri: this.config.callbacksRedirectUris.login,
+      code_verifier: codeVerifier,
+    })
+  }
+
+  /**
+   * Use the refresh token to get a new tokens
+   *
+   * @param refreshToken - The refresh token
+   */
+  public async refreshToken(refreshToken: string) {
+    const decryptedRefreshToken = this.cryptoService.decrypt(refreshToken)
+    const { ids } = this.config
+
+    return this.postRequest<TokenResponse>('/connect/token', {
+      grant_type: 'refresh_token',
+      refresh_token: decryptedRefreshToken,
+      client_secret: ids.secret,
+      client_id: ids.clientId,
+    })
+  }
+
+  /**
+   * This endpoint allows revoking access tokens (reference tokens only) and refresh token.
+   *
+   * @param token - The token to revoke
+   * @param tokenTypeHint - The type of token to revoke (access_token or refresh_token)
+   */
+  public async revokeToken(
+    token: string,
+    tokenTypeHint: 'access_token' | 'refresh_token',
+  ) {
+    const decryptedToken = this.cryptoService.decrypt(token)
+    const { ids } = this.config
+
+    return this.postRequest('/connect/revocation', {
+      token: decryptedToken,
+      token_type_hint: tokenTypeHint,
+      client_secret: ids.secret,
+      client_id: ids.clientId,
+    })
+  }
+}
diff --git a/apps/services/bff/src/app/modules/ids/ids.types.ts b/apps/services/bff/src/app/modules/ids/ids.types.ts
new file mode 100644
index 000000000000..8f88ced6f832
--- /dev/null
+++ b/apps/services/bff/src/app/modules/ids/ids.types.ts
@@ -0,0 +1,83 @@
+export type GetLoginSearchParamsReturnValue = {
+  client_id: string
+  redirect_uri: string
+  response_type: string
+  response_mode: string
+  scope: string
+  state: string
+  code_challenge: string
+  code_challenge_method: string
+  login_hint?: string
+  prompt?: string
+}
+
+export interface ErrorResponse {
+  // Error code, e.g. invalid_grant, invalid_request, ...
+  error: string
+
+  // Human-readable error description,
+  error_description: string
+}
+
+export type ParResponse = {
+  // An identifier for the authorization request, instead of sending the parameters that were just pushed
+  request_uri: string
+
+  // Time in seconds until the request_uri expires
+  expires_in: number
+}
+
+export type TokenResponse = {
+  // ID token issued by the authorization server
+  id_token: string
+
+  // Access token used to access protected resources
+  access_token: string
+
+  // Time in seconds until the access token expires
+  expires_in: number
+
+  // Type of the token issued, typically "Bearer"
+  token_type: string
+
+  // Refresh token used to obtain a new access token
+  refresh_token: string
+
+  // Scopes associated with the access token
+  scope: string
+}
+
+export interface SuccessResponse<T> {
+  type: 'success'
+  data: T
+}
+
+export interface ErrorRes {
+  type: 'error'
+  data: ErrorResponse
+}
+
+export type ApiResponse<T> = SuccessResponse<T> | ErrorRes
+
+export type LogoutTokenPayload = {
+  // Issuer of the token
+  iss: string
+
+  // Subject of the token
+  sub: string
+
+  // Audience of the token
+  aud: string
+
+  // Time when the token was issued
+  iat: number
+
+  // Time when the token expires
+  exp: number
+
+  // Session ID
+  sid: string
+
+  // Unique identifier for the token.
+  jti: string
+}
diff --git a/apps/services/bff/src/app/modules/proxy/dto/api-proxy.dto.ts b/apps/services/bff/src/app/modules/proxy/dto/api-proxy.dto.ts
new file mode 100644
index 000000000000..10085530d836
--- /dev/null
+++ b/apps/services/bff/src/app/modules/proxy/dto/api-proxy.dto.ts
@@ -0,0 +1,6 @@
+import { IsString } from 'class-validator'
+
+export class ApiProxyDto {
+  @IsString()
+  url!: string
+}
diff --git a/apps/services/bff/src/app/modules/proxy/proxy.controller.spec.ts b/apps/services/bff/src/app/modules/proxy/proxy.controller.spec.ts
new file mode 100644
index 000000000000..1e97fcbe39c8
--- /dev/null
+++ b/apps/services/bff/src/app/modules/proxy/proxy.controller.spec.ts
@@ -0,0 +1,246 @@
+import { ConfigType } from '@island.is/nest/config'
+import { CACHE_MANAGER } from '@nestjs/cache-manager'
+import { HttpStatus, INestApplication } from '@nestjs/common'
+import request from 'supertest'
+
+import { setupTestServer } from '../../../../test/setupTestServer'
+import {
+  SESSION_COOKIE_NAME,
+  SID_VALUE,
+  getLoginSearchParmsFn,
+  mockedTokensResponse as tokensResponse,
+} from '../../../../test/sharedConstants'
+import { BffConfig } from '../../bff.config'
+import { hasTimestampExpiredInMS } from '../../utils/has-timestamp-expired-in-ms'
+import { IdsService } from '../ids/ids.service'
+import { TokenResponse } from '../ids/ids.types'
+import { ProxyService } from './proxy.service'
+import { ExecuteStreamRequestArgs } from './proxy.types'
+
+jest.mock('uuid', () => ({
+  v4: jest.fn().mockReturnValue('fake_uuid'),
+}))
+
+const allowedExternalApiUrl = JSON.parse(
+  process.env.BFF_ALLOWED_EXTERNAL_API_URLS as unknown as string,
+)[0]
+
+const mockCacheStore = new Map()
+
+const mockCacheManagerValue = {
+  set: jest.fn((key, value) => mockCacheStore.set(key, value)),
+  get: jest.fn((key) => mockCacheStore.get(key)),
+  del: jest.fn((key) => mockCacheStore.delete(key)),
+}
+
+const EXPIRED_TOKEN_RESPONSE: TokenResponse = {
+  ...tokensResponse,
+  expires_in: 0,
+}
+
+const mockIdsService = {
+  refreshToken: jest.fn().mockResolvedValue({
+    type: 'success',
+    data: tokensResponse,
+  }),
+  getTokens: jest.fn().mockResolvedValue({
+    type: 'success',
+    data: tokensResponse,
+  }),
+  revokeToken: jest.fn().mockResolvedValue({
+    type: 'success',
+  }),
+  getLoginSearchParams: jest.fn().mockImplementation(getLoginSearchParmsFn),
+}
+
+const createTestProxyService = (
+  cb: (args: ExecuteStreamRequestArgs) => void,
+) => {
+  return class TestProxyService extends ProxyService {
+    async executeStreamRequest(args: ExecuteStreamRequestArgs): Promise<void> {
+      cb(args)
+    }
+  }
+}
+
+describe('ProxyController', () => {
+  let app: INestApplication
+  let server: request.SuperTest<request.Test>
+  let capturedArgs: ExecuteStreamRequestArgs
+  let mockConfig: ConfigType<typeof BffConfig>
+
+  beforeAll(async () => {
+    const app = await setupTestServer({
+      override: (builder) =>
+        builder
+          .overrideProvider(CACHE_MANAGER)
+          .useValue(mockCacheManagerValue)
+          .overrideProvider(IdsService)
+          .useValue(mockIdsService)
+          .overrideProvider(ProxyService)
+          .useClass(
+            createTestProxyService((args) => {
+              capturedArgs = args
+              args.res.status(HttpStatus.OK).json({ message: 'success' })
+            }),
+          ),
+    })
+
+    mockConfig = app.get<ConfigType<typeof BffConfig>>(BffConfig.KEY)
+    server = request(app.getHttpServer())
+  })
+
+  afterEach(() => {
+    mockCacheStore.clear()
+    jest.clearAllMocks()
+  })
+
+  afterAll(async () => {
+    if (app) {
+      await app.close()
+    }
+  })
+
+  describe('GET /api', () => {
+    it('should throw 400 bad request when url param is not provided', async () => {
+      // Act
+      const res = await server.get('/api')
+
+      // Assert
+      expect(res.status).toEqual(HttpStatus.BAD_REQUEST)
+    })
+
+    it('should throw 400 bad request when url param is invalid', async () => {
+      // Act
+      const res = await server.get('/api').query({ url: 'http://example.com' })
+
+      // Assert
+      expect(res.status).toEqual(HttpStatus.BAD_REQUEST)
+    })
+
+    it('should throw unauthorized exception when sid cookie is not provided', async () => {
+      // Act
+      const res = await server.get('/api').query({ url: allowedExternalApiUrl })
+
+      // Assert
+      expect(res.status).toEqual(HttpStatus.UNAUTHORIZED)
+    })
+
+    it('should throw unauthorized exception when cache key is not found', async () => {
+      // Act
+      const res = await server
+        .get('/api')
+        .query({ url: allowedExternalApiUrl })
+        .set('Cookie', [`${SESSION_COOKIE_NAME}=${SID_VALUE}`])
+
+      // Assert
+      expect(res.status).toEqual(HttpStatus.UNAUTHORIZED)
+    })
+
+    it('should successfully proxy api request', async () => {
+      // Act
+      await server.get('/login')
+
+      await server
+        .get('/callbacks/login')
+        .set('Cookie', [`${SESSION_COOKIE_NAME}=${SID_VALUE}`])
+        .query({ code: 'some_code', state: SID_VALUE })
+
+      const res = await server
+        .get('/api')
+        .query({ url: allowedExternalApiUrl })
+        .set('Cookie', [`${SESSION_COOKIE_NAME}=${SID_VALUE}`])
+
+      // Assert
+      expect(res.status).toEqual(HttpStatus.OK)
+      expect(res.body).toEqual({ message: 'success' })
+    })
+  })
+
+  describe('GET /api/graphql', () => {
+    beforeEach(() => {
+      jest.clearAllMocks()
+      mockIdsService.getTokens.mockResolvedValue({
+        type: 'success',
+        data: tokensResponse,
+      })
+    })
+
+    it('should throw 401 unauthorized when not logged in', async () => {
+      // Act
+      const res = await server.post('/api/graphql')
+
+      // Assert
+      expect(res.status).toEqual(HttpStatus.UNAUTHORIZED)
+    })
+
+    it('should successfully proxy graphql request', async () => {
+      // Act
+      await server.get('/login')
+
+      await server
+        .get('/callbacks/login')
+        .set('Cookie', [`${SESSION_COOKIE_NAME}=${SID_VALUE}`])
+        .query({ code: 'some_code', state: SID_VALUE })
+
+      const res = await server
+        .post('/api/graphql')
+        .set('Cookie', [`${SESSION_COOKIE_NAME}=${SID_VALUE}`])
+
+      // Assert
+      expect(res.status).toEqual(HttpStatus.OK)
+      expect(res.body).toEqual({ message: 'success' })
+    })
+
+    it('should append query string when proxing requests', async () => {
+      // Act
+      await server.get('/login')
+
+      await server
+        .get('/callbacks/login')
+        .set('Cookie', [`${SESSION_COOKIE_NAME}=${SID_VALUE}`])
+        .query({ code: 'some_code', state: SID_VALUE })
+
+      const res = await server
+        .post('/api/graphql?op=test')
+        .set('Cookie', [`${SESSION_COOKIE_NAME}=${SID_VALUE}`])
+
+      // Assert
+      expect(res.status).toEqual(HttpStatus.OK)
+      expect(capturedArgs.targetUrl).toEqual(
+        `${mockConfig.graphqlApiEndpoint}?op=test`,
+      )
+    })
+
+    it('should correctly identify that the token has expired', () => {
+      const isExpired = hasTimestampExpiredInMS(
+        EXPIRED_TOKEN_RESPONSE.expires_in,
+      )
+
+      expect(isExpired).toBe(true)
+    })
+
+    it('should call refreshToken and cache token response when access_token is expired', async () => {
+      // Arrange
+      mockIdsService.getTokens.mockResolvedValue({
+        type: 'success',
+        data: EXPIRED_TOKEN_RESPONSE,
+      })
+
+      // Act
+      await server.get('/login')
+      await server
+        .get('/callbacks/login')
+        .set('Cookie', [`${SESSION_COOKIE_NAME}=${SID_VALUE}`])
+        .query({ code: 'some_code', state: SID_VALUE })
+
+      const res = await server
+        .post('/api/graphql')
+        .set('Cookie', [`${SESSION_COOKIE_NAME}=${SID_VALUE}`])
+
+      // Assert
+      expect(mockIdsService.refreshToken).toHaveBeenCalled()
+      expect(res.status).toEqual(HttpStatus.OK)
+    })
+  })
+})
diff --git a/apps/services/bff/src/app/modules/proxy/proxy.controller.ts b/apps/services/bff/src/app/modules/proxy/proxy.controller.ts
new file mode 100644
index 000000000000..74af02361ec6
--- /dev/null
+++ b/apps/services/bff/src/app/modules/proxy/proxy.controller.ts
@@ -0,0 +1,39 @@
+import {
+  Controller,
+  Get,
+  Post,
+  Query,
+  Req,
+  Res,
+  VERSION_NEUTRAL,
+} from '@nestjs/common'
+import { Request, Response } from 'express'
+import { qsValidationPipe } from '../../utils/qs-validation-pipe'
+import { ProxyService } from './proxy.service'
+import { ApiProxyDto } from './dto/api-proxy.dto'
+
+@Controller({
+  path: 'api',
+  version: [VERSION_NEUTRAL, '1'],
+})
+export class ProxyController {
+  constructor(private proxyService: ProxyService) {}
+
+  @Get()
+  async forwardGetApiRequest(
+    @Req() req: Request,
+    @Res() res: Response,
+    @Query(qsValidationPipe)
+    query: ApiProxyDto,
+  ): Promise<void> {
+    return this.proxyService.forwardGetApiRequest({ req, res, query })
+  }
+
+  @Post('/graphql')
+  async proxyGraphqlRequest(
+    @Req() req: Request,
+    @Res() res: Response,
+  ): Promise<void> {
+    return this.proxyService.proxyGraphQLRequest({ req, res })
+  }
+}
diff --git a/apps/services/bff/src/app/modules/proxy/proxy.module.ts b/apps/services/bff/src/app/modules/proxy/proxy.module.ts
new file mode 100644
index 000000000000..d767e6c014d6
--- /dev/null
+++ b/apps/services/bff/src/app/modules/proxy/proxy.module.ts
@@ -0,0 +1,13 @@
+import { Module } from '@nestjs/common'
+import { AuthModule } from '../auth/auth.module'
+import { IdsService } from '../ids/ids.service'
+import { ProxyController } from './proxy.controller'
+import { ProxyService } from './proxy.service'
+import { CryptoService } from '../../services/crypto.service'
+
+@Module({
+  imports: [AuthModule],
+  controllers: [ProxyController],
+  providers: [ProxyService, IdsService, CryptoService],
+})
+export class ProxyModule {}
diff --git a/apps/services/bff/src/app/modules/proxy/proxy.service.ts b/apps/services/bff/src/app/modules/proxy/proxy.service.ts
new file mode 100644
index 000000000000..57eee8cd0c9c
--- /dev/null
+++ b/apps/services/bff/src/app/modules/proxy/proxy.service.ts
@@ -0,0 +1,219 @@
+import type { Logger } from '@island.is/logging'
+import { LOGGER_PROVIDER } from '@island.is/logging'
+import {
+  BadRequestException,
+  Inject,
+  Injectable,
+  UnauthorizedException,
+} from '@nestjs/common'
+import { ConfigType } from '@nestjs/config'
+import Agent from 'agentkeepalive'
+import { Request, Response } from 'express'
+import fetch from 'node-fetch'
+import { BffConfig } from '../../bff.config'
+import { CryptoService } from '../../services/crypto.service'
+
+import {
+  AGENT_DEFAULT_FREE_SOCKET_TIMEOUT,
+  AGENT_DEFAULT_MAX_SOCKETS,
+} from '@island.is/shared/constants'
+import { hasTimestampExpiredInMS } from '../../utils/has-timestamp-expired-in-ms'
+import { validateUri } from '../../utils/validate-uri'
+import { AuthService } from '../auth/auth.service'
+import { CachedTokenResponse } from '../auth/auth.types'
+import { CacheService } from '../cache/cache.service'
+import { IdsService } from '../ids/ids.service'
+import { ApiProxyDto } from './dto/api-proxy.dto'
+
+const droppedResponseHeaders = ['access-control-allow-origin']
+
+/**
+ * A custom HTTP agent for managing connections efficiently.
+ * - Keeps connections alive for reuse, reducing connection setup time.
+ * - Configured with custom timeout and socket limits to optimize resource usage.
+ */
+const CUSTOM_AGENT = new Agent({
+  keepAlive: true,
+  timeout: 0,
+  freeSocketTimeout: AGENT_DEFAULT_FREE_SOCKET_TIMEOUT,
+  maxSockets: AGENT_DEFAULT_MAX_SOCKETS,
+})
+
+@Injectable()
+export class ProxyService {
+  constructor(
+    @Inject(LOGGER_PROVIDER)
+    private logger: Logger,
+
+    @Inject(BffConfig.KEY)
+    private readonly config: ConfigType<typeof BffConfig>,
+
+    private readonly cacheService: CacheService,
+    private readonly idsService: IdsService,
+    private readonly authService: AuthService,
+    private readonly cryptoService: CryptoService,
+  ) {}
+
+  /**
+   * This method gets access token from the cache by session ID(sid).
+   * - If the token is expired, it will attempt to update tokens with the refresh token from cache.
+   * - Then access token is decrypted and returned.
+   */
+  private async getAccessToken(req: Request) {
+    const sid = req.cookies['sid']
+
+    if (!sid) {
+      throw new UnauthorizedException()
+    }
+
+    try {
+      let cachedTokenResponse =
+        await this.cacheService.get<CachedTokenResponse>(
+          this.cacheService.createSessionKeyType('current', sid),
+        )
+
+      if (hasTimestampExpiredInMS(cachedTokenResponse.accessTokenExp)) {
+        const tokenResponse = await this.idsService.refreshToken(
+          cachedTokenResponse.encryptedRefreshToken,
+        )
+
+        if (tokenResponse.type === 'error') {
+          throw tokenResponse.data
+        }
+
+        cachedTokenResponse = await this.authService.updateTokenCache(
+          tokenResponse.data,
+        )
+      }
+
+      return this.cryptoService.decrypt(
+        cachedTokenResponse.encryptedAccessToken,
+      )
+    } catch (error) {
+      this.logger.error('Error getting access token:', error)
+
+      throw new UnauthorizedException()
+    }
+  }
+
+  /**
+   * This method proxies the request to the target URL and streams the response back to the client.
+   */
+  async executeStreamRequest({
+    targetUrl,
+    accessToken,
+    req,
+    res,
+    body,
+  }: {
+    targetUrl: string
+    accessToken: string
+    req: Request
+    res: Response
+    body?: Record<string, unknown>
+  }) {
+    try {
+      const reqHeaderContentType = req.headers['content-type']
+      const response = await fetch(targetUrl, {
+        method: 'POST',
+        headers: {
+          'Content-Type': reqHeaderContentType || 'application/json',
+          Authorization: `Bearer ${accessToken}`,
+        },
+        body: JSON.stringify(body ?? req.body),
+        agent: CUSTOM_AGENT,
+      })
+
+      // Set the status code of the response
+      res.status(response.status)
+
+      response.headers.forEach((value, key) => {
+        // Only set headers that are not in the droppedResponseHeaders array
+        if (!droppedResponseHeaders.includes(key.toLowerCase())) {
+          res.setHeader(key, value)
+        }
+      })
+
+      // Pipe the response body directly to the client
+      response.body.pipe(res)
+
+      response.body.on('error', (err) => {
+        this.logger.error('Proxy stream error:', err)
+
+        // This check ensures that `res.end()` is only called if the response has not already been ended.
+        if (!res.writableEnded) {
+          // Ensure the response is properly ended if an error occurs
+          res.end()
+        }
+      })
+
+      // Make sure to end the response when the stream ends,
+      // so that the client knows the request is complete.
+      response.body.on('end', () => {
+        if (!res.writableEnded) {
+          res.end()
+        }
+      })
+    } catch (error) {
+      this.logger.error('Error during proxy request processing: ', error)
+
+      res.status(error.status || 500).send('Failed to proxy request')
+    }
+  }
+
+  /**
+   * Proxies an incoming HTTP POST request to a target GraphQL API, handling authentication, token refresh,
+   * and response streaming.
+   */
+  public async proxyGraphQLRequest({
+    req,
+    res,
+  }: {
+    req: Request
+    res: Response
+  }): Promise<void> {
+    const accessToken = await this.getAccessToken(req)
+    const queryString = req.url.split('?')[1]
+    const targetUrl = `${this.config.graphqlApiEndpoint}${
+      queryString ? `?${queryString}` : ''
+    }`
+
+    this.executeStreamRequest({
+      accessToken,
+      targetUrl,
+      req,
+      res,
+    })
+  }
+
+  /**
+   * Forwards an incoming HTTP GET request to the specified URL (provided in the query string),
+   * managing authentication, refreshing tokens if needed, and streaming the response back to the client.
+   */
+  async forwardGetApiRequest({
+    req,
+    res,
+    query,
+  }: {
+    req: Request
+    res: Response
+    query: ApiProxyDto
+  }) {
+    const { url } = query
+
+    if (!validateUri(url, this.config.allowedExternalApiUrls)) {
+      this.logger.error('Invalid external api url provided:', url)
+
+      throw new BadRequestException('Proxing url failed!')
+    }
+
+    const accessToken = await this.getAccessToken(req)
+
+    this.executeStreamRequest({
+      accessToken,
+      targetUrl: url,
+      req,
+      res,
+    })
+  }
+}
diff --git a/apps/services/bff/src/app/modules/proxy/proxy.types.ts b/apps/services/bff/src/app/modules/proxy/proxy.types.ts
new file mode 100644
index 000000000000..1cde81d086e7
--- /dev/null
+++ b/apps/services/bff/src/app/modules/proxy/proxy.types.ts
@@ -0,0 +1,9 @@
+import { Request, Response } from 'express'
+
+export type ExecuteStreamRequestArgs = {
+  targetUrl: string
+  accessToken: string
+  req: Request
+  res: Response
+  body?: Record<string, unknown>
+}
diff --git a/apps/services/bff/src/app/modules/user/dto/get-user.dto.ts b/apps/services/bff/src/app/modules/user/dto/get-user.dto.ts
new file mode 100644
index 000000000000..e059374f7549
--- /dev/null
+++ b/apps/services/bff/src/app/modules/user/dto/get-user.dto.ts
@@ -0,0 +1,7 @@
+import { IsOptional, IsString } from 'class-validator'
+
+export class GetUserDto {
+  @IsOptional()
+  @IsString()
+  refresh?: string
+}
diff --git a/apps/services/bff/src/app/modules/user/user.controller.ts b/apps/services/bff/src/app/modules/user/user.controller.ts
new file mode 100644
index 000000000000..2e3045db2b67
--- /dev/null
+++ b/apps/services/bff/src/app/modules/user/user.controller.ts
@@ -0,0 +1,25 @@
+import type { Request } from 'express'
+
+import type { BffUser } from '@island.is/shared/types'
+import { Controller, Get, Query, Req, VERSION_NEUTRAL } from '@nestjs/common'
+
+import { qsValidationPipe } from '../../utils/qs-validation-pipe'
+import { GetUserDto } from './dto/get-user.dto'
+import { UserService } from './user.service'
+
+@Controller({
+  path: 'user',
+  version: [VERSION_NEUTRAL, '1'],
+})
+export class UserController {
+  constructor(private readonly userService: UserService) {}
+
+  @Get()
+  async getUser(
+    @Req() req: Request,
+    @Query(qsValidationPipe)
+    query: GetUserDto,
+  ): Promise<BffUser> {
+    return this.userService.getUser(req, query.refresh === 'true')
+  }
+}
diff --git a/apps/services/bff/src/app/modules/user/user.module.ts b/apps/services/bff/src/app/modules/user/user.module.ts
new file mode 100644
index 000000000000..6ad5d5368d65
--- /dev/null
+++ b/apps/services/bff/src/app/modules/user/user.module.ts
@@ -0,0 +1,13 @@
+import { Module } from '@nestjs/common'
+import { AuthModule } from '../auth/auth.module'
+import { IdsService } from '../ids/ids.service'
+import { UserController } from './user.controller'
+import { UserService } from './user.service'
+import { CryptoService } from '../../services/crypto.service'
+
+@Module({
+  imports: [AuthModule],
+  controllers: [UserController],
+  providers: [UserService, IdsService, CryptoService],
+})
+export class UserModule {}
diff --git a/apps/services/bff/src/app/modules/user/user.service.ts b/apps/services/bff/src/app/modules/user/user.service.ts
new file mode 100644
index 000000000000..c892586e9156
--- /dev/null
+++ b/apps/services/bff/src/app/modules/user/user.service.ts
@@ -0,0 +1,82 @@
+import type { Logger } from '@island.is/logging'
+import { LOGGER_PROVIDER } from '@island.is/logging'
+import { Inject, Injectable, UnauthorizedException } from '@nestjs/common'
+import { Request } from 'express'
+
+import { BffUser } from '@island.is/shared/types'
+import { SESSION_COOKIE_NAME } from '../../constants/cookies'
+import { CryptoService } from '../../services/crypto.service'
+
+import { hasTimestampExpiredInMS } from '../../utils/has-timestamp-expired-in-ms'
+import { AuthService } from '../auth/auth.service'
+import { CachedTokenResponse } from '../auth/auth.types'
+import { CacheService } from '../cache/cache.service'
+import { IdsService } from '../ids/ids.service'
+
+@Injectable()
+export class UserService {
+  constructor(
+    @Inject(LOGGER_PROVIDER)
+    private logger: Logger,
+
+    private readonly cryptoService: CryptoService,
+    private readonly cacheService: CacheService,
+    private readonly idsService: IdsService,
+    private readonly authService: AuthService,
+  ) {}
+
+  private mapToBffUser(value: CachedTokenResponse): BffUser {
+    return {
+      scopes: value.scopes,
+      profile: value.userProfile,
+    }
+  }
+
+  public async getUser(req: Request, refresh = true): Promise<BffUser> {
+    const sid = req.cookies[SESSION_COOKIE_NAME]
+
+    if (!sid) {
+      throw new UnauthorizedException()
+    }
+
+    try {
+      const cachedTokenResponse =
+        await this.cacheService.get<CachedTokenResponse>(
+          this.cacheService.createSessionKeyType('current', sid),
+          // Do not throw error if the key is not found
+          false,
+        )
+
+      if (!cachedTokenResponse) {
+        throw new UnauthorizedException()
+      }
+
+      const accessTokenHasExpired = hasTimestampExpiredInMS(
+        cachedTokenResponse.accessTokenExp,
+      )
+
+      if (accessTokenHasExpired && !refresh) {
+        // Get new token data with refresh token
+        const tokenResponse = await this.idsService.refreshToken(
+          cachedTokenResponse.encryptedRefreshToken,
+        )
+
+        if (tokenResponse.type === 'error') {
+          throw tokenResponse.data
+        }
+
+        // Update cache with new token data
+        const value: CachedTokenResponse =
+          await this.authService.updateTokenCache(tokenResponse.data)
+
+        return this.mapToBffUser(value)
+      }
+
+      return this.mapToBffUser(cachedTokenResponse)
+    } catch (error) {
+      this.logger.error('Get user error: ', error)
+
+      throw new UnauthorizedException()
+    }
+  }
+}
diff --git a/apps/services/bff/src/app/services/crypto.service.spec.ts b/apps/services/bff/src/app/services/crypto.service.spec.ts
new file mode 100644
index 000000000000..87528e308640
--- /dev/null
+++ b/apps/services/bff/src/app/services/crypto.service.spec.ts
@@ -0,0 +1,92 @@
+import type { Logger } from '@island.is/logging'
+import { LOGGER_PROVIDER } from '@island.is/logging'
+import { Test, TestingModule } from '@nestjs/testing'
+import crypto from 'crypto'
+import { CryptoService } from './crypto.service'
+import { BffConfig } from '../bff.config'
+
+const DECRYPTED_TEXT = 'Hello, World!'
+
+Object.defineProperty(global, 'crypto', {
+  value: {
+    getRandomValues: (arr: Buffer) => crypto.randomBytes(arr.length),
+  },
+})
+
+const invalidConfig = {
+  tokenSecretBase64: 'shortkey',
+}
+
+const validConfig = {
+  // A valid 32-byte base64 key
+  tokenSecretBase64: 'ABHlmq6Ic6Ihip4OnTa1MeUXtHFex8IT/mFZrjhsme0=',
+}
+
+const mockLogger = {
+  error: jest.fn(),
+} as unknown as Logger
+
+const createModule = async (config = validConfig): Promise<TestingModule> => {
+  return Test.createTestingModule({
+    providers: [
+      CryptoService,
+      { provide: LOGGER_PROVIDER, useValue: mockLogger },
+      { provide: BffConfig.KEY, useValue: config },
+    ],
+  }).compile()
+}
+
+describe('CryptoService Constructor', () => {
+  it('should throw an error if "tokenSecretBase64" is not 32 bytes long', async () => {
+    try {
+      const module = await createModule(invalidConfig)
+      module.get<CryptoService>(CryptoService)
+      // Fail the test if no error is thrown
+      fail('Expected constructor to throw an error, but it did not.')
+    } catch (error) {
+      expect(error.message).toBe(
+        '"tokenSecretBase64" secret must be exactly 32 bytes (256 bits) long.',
+      )
+    }
+  })
+
+  it('should not throw an error if "tokenSecretBase64" is 32 bytes long', async () => {
+    try {
+      const module = await createModule()
+      module.get<CryptoService>(CryptoService)
+      // No error means the test passes
+    } catch (error) {
+      fail(`Expected no error, but received: ${error.message}`)
+    }
+  })
+})
+
+describe('CryptoService', () => {
+  let service: CryptoService
+
+  beforeEach(async () => {
+    const module = await createModule()
+    service = module.get<CryptoService>(CryptoService)
+  })
+
+  describe('encrypt', () => {
+    it('should encrypt and return a string containing IV and encrypted text', () => {
+      const encryptedText = service.encrypt(DECRYPTED_TEXT)
+      const [algorithm, ivBase64, encrypted] = encryptedText.split(':')
+
+      expect(algorithm).toEqual('aes-256-cbc')
+      // IV in base64 (16 bytes) should be 24 characters long
+      expect(ivBase64).toHaveLength(24)
+      expect(encrypted.length).toBeGreaterThan(0)
+    })
+  })
+
+  describe('decrypt', () => {
+    it('should decrypt an encrypted string and return the original text', () => {
+      const encryptedText = service.encrypt(DECRYPTED_TEXT)
+      const decryptedText = service.decrypt(encryptedText)
+
+      expect(decryptedText).toBe(DECRYPTED_TEXT)
+    })
+  })
+})
diff --git a/apps/services/bff/src/app/services/crypto.service.ts b/apps/services/bff/src/app/services/crypto.service.ts
new file mode 100644
index 000000000000..f5b39526b7c1
--- /dev/null
+++ b/apps/services/bff/src/app/services/crypto.service.ts
@@ -0,0 +1,107 @@
+import type { Logger } from '@island.is/logging'
+import { LOGGER_PROVIDER } from '@island.is/logging'
+import { Inject, Injectable } from '@nestjs/common'
+import { ConfigType } from '@nestjs/config'
+import * as crypto from 'crypto'
+import { BffConfig } from '../bff.config'
+
+@Injectable()
+export class CryptoService {
+  private readonly algorithm = 'aes-256-cbc'
+  private readonly key: Buffer
+
+  constructor(
+    @Inject(LOGGER_PROVIDER)
+    private logger: Logger,
+
+    @Inject(BffConfig.KEY)
+    private readonly config: ConfigType<typeof BffConfig>,
+  ) {
+    // Decode from base64 to binary
+    this.key = Buffer.from(this.config.tokenSecretBase64, 'base64')
+
+    // Ensure the key is exactly 32 bytes (256 bits) long
+    if (this.key.length !== 32) {
+      throw new Error(
+        '"tokenSecretBase64" secret must be exactly 32 bytes (256 bits) long.',
+      )
+    }
+  }
+
+  /**
+   * Encrypts a given text using the AES-256-CBC encryption algorithm.
+   *
+   * @param text The plain text to encrypt.
+   * @returns IV encrypted text for decryption
+   *
+   * @example
+   * const encrypted = cryptoService.encrypt('Hello, World!')
+   * Output: 'aes-256-cbc:Ghs8TV5veHqJkGthWklAAw==:YWJjZGVmMTIzNDU2Nzg5MGFiY2RlZjEyMzQ1Njc4OTA='
+   */
+  encrypt(text: string): string {
+    try {
+      // Generate a random 16-byte initialization vector (IV) for the encryption
+      // IV is a unique value used with the key to make each encryption unique, even with the same plaintext and key.
+      const iv = crypto.randomBytes(16)
+
+      // Create a Cipher object using the algorithm, encryption key, and initialization vector (IV)
+      const cipher = crypto.createCipheriv(this.algorithm, this.key, iv)
+
+      // Encrypt the text in 'utf8' format and encode the result as base64
+      let encrypted = cipher.update(text, 'utf8', 'base64')
+
+      // Finalize the encryption, appending any remaining data
+      encrypted += cipher.final('base64')
+
+      // Return the algorithm, IV, and the encrypted text, separated by colons
+      // The IV is used in decryption.
+      return `${this.algorithm}:${iv.toString('base64')}:${encrypted}`
+    } catch (error) {
+      this.logger.error('Error encrypting text:', { message: error.message })
+
+      throw new Error('Failed to encrypt the text.')
+    }
+  }
+
+  /**
+   * Decrypts a given text using the AES-256-CBC decryption algorithm.
+   *
+   * @param encryptedText The IV encrypted text to decrypt.
+   * @returns The original plain text.
+   *
+   * @example
+   * const decrypted = cryptoService.decrypt('aes-256-cbc:Ghs8TV5veHqJkGthWklAAw==:YWJjZGVmMTIzNDU2Nzg5MGFiY2RlZjEyMzQ1Njc4OTA=')
+   * Output: 'Hello, World!'
+   */
+  decrypt(encryptedText: string): string {
+    try {
+      // Split the input into the algorithm, IV (initialization vector), and the encrypted text
+      const [_algorithm, ivBase64, encrypted] = encryptedText.split(':')
+
+      // If encryptedText is malformed, this could lead to runtime errors or security vulnerabilities.
+      // This check ensures all parts are present before proceeding.
+      if (!ivBase64 || !encrypted) {
+        throw new Error('Invalid encrypted text format.')
+      }
+
+      // Convert the base64-encoded IV back into a Buffer
+      const iv = Buffer.from(ivBase64, 'base64')
+
+      // Create a Decipher object using the same algorithm, key, and IV
+      const decipher = crypto.createDecipheriv(this.algorithm, this.key, iv)
+
+      // Decrypt the encrypted text from base64 to utf8 format
+      let decrypted = decipher.update(encrypted, 'base64', 'utf8')
+
+      // Finalize the decryption, appending any remaining data
+      decrypted += decipher.final('utf8')
+
+      // Return the decrypted plaintext
+      return decrypted
+    } catch (error) {
+      this.logger.error('Error decrypting text:', { message: error.message })
+
+      throw new Error('Failed to decrypt the text.')
+    }
+  }
+}
diff --git a/apps/services/bff/src/app/services/pkce.service.spec.ts b/apps/services/bff/src/app/services/pkce.service.spec.ts
new file mode 100644
index 000000000000..6b0431f45a7c
--- /dev/null
+++ b/apps/services/bff/src/app/services/pkce.service.spec.ts
@@ -0,0 +1,74 @@
+import { Test, TestingModule } from '@nestjs/testing'
+import { PKCEService } from './pkce.service'
+
+const ALLOWED_VERIFIER_CHARACTERS_REGEX = /^[a-zA-Z0-9-._~]+$/
+
+describe('PKCEService', () => {
+  let service: PKCEService
+
+  beforeEach(async () => {
+    const module: TestingModule = await Test.createTestingModule({
+      providers: [PKCEService],
+    }).compile()
+
+    service = module.get<PKCEService>(PKCEService)
+  })
+
+  describe('generateVerifier', () => {
+    const verifierTestCases = [
+      { length: 50, description: 'default length 50' },
+      { length: 64, description: 'specified length 64' },
+      { length: 43, description: 'minimum length 43' },
+      { length: 128, description: 'maximum length 128' },
+    ]
+
+    verifierTestCases.forEach(({ length, description }) => {
+      it(`should generate a verifier of ${description}`, async () => {
+        const verifier = await service.generateVerifier(length)
+        expect(verifier).toHaveLength(length)
+        // Check allowed characters
+        expect(verifier).toMatch(ALLOWED_VERIFIER_CHARACTERS_REGEX)
+      })
+    })
+
+    it('should throw an error if the length is less than 43', async () => {
+      await expect(service.generateVerifier(42)).rejects.toThrow(
+        'Length must be a positive integer between 43 and 128',
+      )
+    })
+
+    it('should throw an error if the length is greater than 128', async () => {
+      await expect(service.generateVerifier(129)).rejects.toThrow(
+        'Length must be a positive integer between 43 and 128',
+      )
+    })
+  })
+
+  describe('generateCodeVerifier', () => {
+    it('should generate a code verifier of default length 50', async () => {
+      const verifier = await service.generateCodeVerifier()
+      expect(verifier).toHaveLength(50)
+      // Check allowed characters
+      expect(verifier).toMatch(ALLOWED_VERIFIER_CHARACTERS_REGEX)
+    })
+  })
+
+  describe('generateCodeChallenge', () => {
+    it('should generate a valid code challenge from a given verifier', async () => {
+      const verifier = 'testVerifier123'
+      const challenge = await service.generateCodeChallenge(verifier)
+      expect(challenge).toBeDefined()
+      // Match base64url format
+      expect(challenge).toMatch(/^[a-zA-Z0-9-_]+$/)
+    })
+  })
+
+  describe('getRandomValues', () => {
+    it('should generate an array of random values of specified length', async () => {
+      const length = 10
+      const randomValues = await service.getRandomValues(length)
+      expect(randomValues).toBeInstanceOf(Uint8Array)
+      expect(randomValues).toHaveLength(length)
+    })
+  })
+})
diff --git a/apps/services/bff/src/app/services/pkce.service.ts b/apps/services/bff/src/app/services/pkce.service.ts
new file mode 100644
index 000000000000..96c2375b5b2c
--- /dev/null
+++ b/apps/services/bff/src/app/services/pkce.service.ts
@@ -0,0 +1,81 @@
+import { Injectable } from '@nestjs/common'
+import { promisify } from 'util'
+import * as crypto from 'crypto'
+
+const randomBytesAsync = promisify(crypto.randomBytes)
+
+@Injectable()
+export class PKCEService {
+  /**
+   * Creates an array of length "size" of random bytes
+   * @returns Array of random ints (0 to 255)
+   */
+  async getRandomValues(size: number): Promise<Uint8Array> {
+    const randomBytes = await randomBytesAsync(size)
+
+    return new Uint8Array(randomBytes)
+  }
+
+  /**
+   * Generate a PKCE code verifier
+   * Generates a 50-character long verifier by default
+   */
+  public async generateCodeVerifier(): Promise<string> {
+    return this.generateVerifier(50)
+  }
+
+  /**
+   * Generate a PKCE code challenge based on the verifier
+   * Uses SHA-256 hashing and Base64 URL encoding
+   */
+  public async generateCodeChallenge(codeVerifier: string): Promise<string> {
+    // Convert the verifier to a Uint8Array
+    const encoder = new TextEncoder()
+    const data = encoder.encode(codeVerifier)
+
+    // Use Web Crypto API for async hashing
+    const hashBuffer = await crypto.webcrypto.subtle.digest('SHA-256', data)
+
+    // and then Base64 URL encode
+    return this.base64UrlEncode(Buffer.from(hashBuffer))
+  }
+
+  /**
+   * Generate a PKCE challenge verifier
+   * Generates cryptographically strong random string
+   *
+   * @param length The length of the verifier to generate
+   *
+   * Note! According to the RFC from OAuth 2.0 PKCE RFC 7636, the PKCE code verifier must have a length between 43 and 128 characters.
+   */
+  async generateVerifier(length = 50): Promise<string> {
+    // Enforce PKCE length requirements: 43 <= length <= 128
+    if (!Number.isInteger(length) || length < 43 || length > 128) {
+      throw new Error(
+        'Length must be a positive integer between 43 and 128, inclusive',
+      )
+    }
+
+    const mask =
+      'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~'
+
+    let result = ''
+    const randomUints = await this.getRandomValues(length)
+
+    for (let i = 0; i < length; i++) {
+      // Cap the value of the randomIndex to mask.length - 1
+      const randomIndex = randomUints[i] % mask.length
+      result += mask[randomIndex]
+    }
+
+    return result
+  }
+
+  /**
+   * Base64 URL encode the buffer input
+   * This utility function converts a Buffer to a Base64 URL-safe string,
+   */
+  private base64UrlEncode(buffer: Buffer): string {
+    return buffer.toString('base64url')
+  }
+}
diff --git a/apps/services/bff/src/app/utils/create-error-query-str.ts b/apps/services/bff/src/app/utils/create-error-query-str.ts
new file mode 100644
index 000000000000..cf7a8b927e02
--- /dev/null
+++ b/apps/services/bff/src/app/utils/create-error-query-str.ts
@@ -0,0 +1,17 @@
+export type CreateErrorQueryStrArgs = {
+  code: number
+  error: string
+}
+
+/**
+ * This utility function creates a query string with the bff_error and bff_error_description parameters
+ */
+export const createErrorQueryStr = ({
+  code,
+  error,
+}: CreateErrorQueryStrArgs) => {
+  return new URLSearchParams({
+    bff_error_code: code.toString(),
+    bff_error_description: error,
+  }).toString()
+}
diff --git a/apps/services/bff/src/app/utils/has-timestamp-expired-in-ms.ts b/apps/services/bff/src/app/utils/has-timestamp-expired-in-ms.ts
new file mode 100644
index 000000000000..87762126c8c6
--- /dev/null
+++ b/apps/services/bff/src/app/utils/has-timestamp-expired-in-ms.ts
@@ -0,0 +1,6 @@
+/**
+ * Check if a Unix timestamp (in milliseconds) has expired
+ */
+export const hasTimestampExpiredInMS = (unixTimestampMs: number): boolean => {
+  return unixTimestampMs < Date.now()
+}
diff --git a/apps/services/bff/src/app/utils/qs-validation-pipe.ts b/apps/services/bff/src/app/utils/qs-validation-pipe.ts
new file mode 100644
index 000000000000..d53d89802b0f
--- /dev/null
+++ b/apps/services/bff/src/app/utils/qs-validation-pipe.ts
@@ -0,0 +1,7 @@
+import { ValidationPipe } from '@nestjs/common'
+
+export const qsValidationPipe = new ValidationPipe({
+  transform: true,
+  transformOptions: { enableImplicitConversion: true },
+  forbidNonWhitelisted: true,
+})
diff --git a/apps/services/bff/src/app/utils/remove-trailing-slash.ts b/apps/services/bff/src/app/utils/remove-trailing-slash.ts
new file mode 100644
index 000000000000..3a835b60cf3c
--- /dev/null
+++ b/apps/services/bff/src/app/utils/remove-trailing-slash.ts
@@ -0,0 +1,13 @@
+/**
+ * Remove trailing slash from a string
+ *
+ * @example
+ * removeTrailingSlash('https://example.com/') // 'https://example.com'
+ */
+export const removeTrailingSlash = (str: string) => {
+  if (!str || str === '/') {
+    return ''
+  }
+
+  return str.endsWith('/') ? str.slice(0, -1) : str
+}
diff --git a/apps/services/bff/src/app/utils/validate-uri.spec.ts b/apps/services/bff/src/app/utils/validate-uri.spec.ts
new file mode 100644
index 000000000000..cdb41687af6e
--- /dev/null
+++ b/apps/services/bff/src/app/utils/validate-uri.spec.ts
@@ -0,0 +1,84 @@
+import { validateUri } from './validate-uri'
+
+describe('validateUri', () => {
+  const allowedUris = [
+    'https://beta.dev01.devland.is/stjornbord',
+    'https://api.stjornbord.island.is',
+  ]
+
+  it('should return false if uri is not a string', () => {
+    expect(validateUri(123 as any, allowedUris)).toBe(false)
+  })
+
+  it('should return false if allowedUris is not an array', () => {
+    expect(
+      validateUri('https://beta.dev01.devland.is/stjornbord', {} as any),
+    ).toBe(false)
+  })
+
+  it('should return false if allowedUri is not a string', () => {
+    const invalidAllowedUris = [123 as any, 'https://api.stjornbord.island.is']
+    expect(
+      validateUri(
+        'https://beta.dev01.devland.is/stjornbord',
+        invalidAllowedUris,
+      ),
+    ).toBe(false)
+  })
+
+  it('should return true for URI with the same hostname in different caseing', () => {
+    expect(
+      validateUri('https://Beta.Dev01.Devland.Is/stjornbord', allowedUris),
+    ).toBe(true)
+  })
+
+  it('should return true for valid allowed URI', () => {
+    expect(
+      validateUri('https://beta.dev01.devland.is/stjornbord', allowedUris),
+    ).toBe(true)
+  })
+
+  it('should return false for subdomain attacks', () => {
+    expect(
+      validateUri(
+        // A subdomain that could pass if validation isn't strict
+        'https://beta.dev01.devland.is.evil.is/stjornbord',
+        allowedUris,
+      ),
+    ).toBe(false)
+  })
+
+  it('should return false for protocol mismatch', () => {
+    expect(
+      validateUri('http://beta.dev01.devland.is/stjornbord', allowedUris),
+    ).toBe(false)
+  })
+
+  it('should return false for path traversal', () => {
+    expect(
+      validateUri(
+        // Path traversal should fail
+        'https://beta.dev01.devland.is/stjornbord/../admin',
+        allowedUris,
+      ),
+    ).toBe(false)
+  })
+
+  it('should return false for invalid hostname', () => {
+    expect(
+      validateUri('https://malicious-site.com/stjornbord', allowedUris),
+    ).toBe(false)
+  })
+
+  it('should return true for another valid allowed URI', () => {
+    expect(validateUri('https://api.stjornbord.island.is', allowedUris)).toBe(
+      true,
+    )
+  })
+
+  it('should return false for partially matching but different path', () => {
+    expect(
+      validateUri('https://beta.dev01.devland.is/different-path', allowedUris),
+    ).toBe(false)
+  })
+})
diff --git a/apps/services/bff/src/app/utils/validate-uri.ts b/apps/services/bff/src/app/utils/validate-uri.ts
new file mode 100644
index 000000000000..0a084f35b005
--- /dev/null
+++ b/apps/services/bff/src/app/utils/validate-uri.ts
@@ -0,0 +1,45 @@
+import { URL } from 'url'
+
+/**
+ * Validates the URI against allowed URIs to block external URLs.
+ *
+ * Security Considerations:
+ * - Subdomain Attacks: Prevents bypassing validation via subdomains (e.g., `evil.example.com`).
+ * - Path Traversal: Prevents accessing unintended paths, e.g. https://island.is.evil.is/some-path could pass validation if https://island.is is the allowed URL when using startWith() for example.
+ * - Protocol Hijacking: Ensures the protocol (e.g., `https`) matches exactly.
+ *
+ * This function compares both the protocol, hostname, and optionally, the pathname.
+ *
+ * @param uri - The URI to validate.
+ * @param allowedUris - List of allowed URIs.
+ * @returns True if the URI is valid, false otherwise.
+ */
+export const validateUri = (uri: string, allowedUris: string[]): boolean => {
+  //  input validation for extra security
+  if (!uri || typeof uri !== 'string' || !Array.isArray(allowedUris)) {
+    return false
+  }
+
+  try {
+    // Normalize the URI to lowercase for case-insensitive comparison
+    const parsedUri = new URL(uri.trim().toLowerCase())
+
+    return allowedUris.some((allowedUri) => {
+      if (typeof allowedUri !== 'string') {
+        return false
+      }
+
+      const parsedAllowedUri = new URL(allowedUri.trim().toLowerCase())
+
+      const isSameProtocol = parsedUri.protocol === parsedAllowedUri.protocol
+      const isSameHostname = parsedUri.hostname === parsedAllowedUri.hostname
+      const isSamePathname =
+        parsedUri.pathname === parsedAllowedUri.pathname ||
+        parsedUri.pathname.startsWith(parsedAllowedUri.pathname)
+
+      return isSameProtocol && isSameHostname && isSamePathname
+    })
+  } catch {
+    return false
+  }
+}
diff --git a/apps/services/bff/src/environment/environment.schema.ts b/apps/services/bff/src/environment/environment.schema.ts
new file mode 100644
index 000000000000..c660cfd14845
--- /dev/null
+++ b/apps/services/bff/src/environment/environment.schema.ts
@@ -0,0 +1,27 @@
+import { z } from 'zod'
+
+const KEY_PATH_ENV_VAR = 'BFF_CLIENT_KEY_PATH'
+
+export const environmentSchema = z.strictObject({
+  production: z.boolean().default(false),
+  port: z.preprocess(
+    (val) => (val ? parseInt(val as string, 10) : 3010),
+    z
+      .number({ required_error: 'PORT must be a valid number' })
+      .min(1)
+      .max(65535),
+  ),
+  /**
+   * The global prefix for the API
+   */
+  keyPath: z
+    .string({
+      required_error: `${KEY_PATH_ENV_VAR} is required`,
+    })
+    .refine((val) => !val.endsWith('/bff'), {
+      message: `${KEY_PATH_ENV_VAR} must not end with /bff`,
+    }),
+  name: z.string({ required_error: 'BFF_NAME is required' }),
+})
+
+export type BffEnvironment = z.infer<typeof environmentSchema>
diff --git a/apps/services/bff/src/environment/environment.ts b/apps/services/bff/src/environment/environment.ts
new file mode 100644
index 000000000000..f98c1992f1dc
--- /dev/null
+++ b/apps/services/bff/src/environment/environment.ts
@@ -0,0 +1,12 @@
+import { BffEnvironment, environmentSchema } from './environment.schema'
+
+export const isProduction = process.env.NODE_ENV === 'production'
+
+const parsedEnvironment = environmentSchema.parse({
+  production: isProduction,
+  port: process.env.PORT,
+  keyPath: process.env.BFF_CLIENT_KEY_PATH,
+  name: process.env.BFF_NAME,
+})
+
+export const environment: BffEnvironment = parsedEnvironment
diff --git a/apps/services/bff/src/environment/index.ts b/apps/services/bff/src/environment/index.ts
new file mode 100644
index 000000000000..1953a2e9b9f0
--- /dev/null
+++ b/apps/services/bff/src/environment/index.ts
@@ -0,0 +1 @@
+export * from './environment'
diff --git a/apps/services/bff/src/main.ts b/apps/services/bff/src/main.ts
new file mode 100644
index 000000000000..2e68f2bcbc6e
--- /dev/null
+++ b/apps/services/bff/src/main.ts
@@ -0,0 +1,12 @@
+import { bootstrap } from '@island.is/infra-nest-server'
+
+import { AppModule } from './app/app.module'
+import { environment } from './environment'
+
+bootstrap({
+  appModule: AppModule,
+  name: 'bff',
+  port: environment.port,
+  globalPrefix: `${environment.keyPath}/bff`,
+  healthCheck: true,
+})
diff --git a/apps/services/bff/test/setup.ts b/apps/services/bff/test/setup.ts
new file mode 100644
index 000000000000..9c8cbeee3c85
--- /dev/null
+++ b/apps/services/bff/test/setup.ts
@@ -0,0 +1,21 @@
+process.env.PORT = '3010'
+process.env.BFF_NAME = 'testclient'
+process.env.BFF_CACHE_USER_PROFILE_TTL_MS = '3595000' // 1 hour - 5 seconds
+process.env.BFF_LOGIN_ATTEMPT_TTL_MS = '604800000' // 1 week
+process.env.IDENTITY_SERVER_CLIENT_SECRET = 'some secret'
+process.env.IDENTITY_SERVER_ISSUER_URL =
+  'https://identity-server.dev01.devland.is'
+process.env.IDENTITY_SERVER_CLIENT_SCOPES = '["testscope"]'
+process.env.IDENTITY_SERVER_CLIENT_ID = '@test_client_id'
+process.env.BFF_PAR_SUPPORT_ENABLED = 'false'
+
+process.env.BFF_CLIENT_KEY_PATH = '/testclient'
+process.env.BFF_CLIENT_BASE_URL = 'http://test-client.com'
+process.env.BFF_ALLOWED_REDIRECT_URIS = '["http://test-client.com/testclient"]'
+process.env.BFF_ALLOWED_EXTERNAL_API_URLS = '["https://api.external.com"]'
+process.env.BFF_CALLBACKS_BASE_PATH =
+  'http://localhost:3010/testclient/bff/callbacks'
+process.env.BFF_LOGOUT_REDIRECT_URI = 'http://localhost:4200/testclient'
+process.env.BFF_PROXY_API_ENDPOINT = 'http://localhost:4444/api/graphql'
+process.env.BFF_TOKEN_SECRET_BASE64 =
+  'Y0ROrC3mxDBnveN+EpAnLtSubttyjZZWcV43dyk7OQI='
diff --git a/apps/services/bff/test/setupTestServer.ts b/apps/services/bff/test/setupTestServer.ts
new file mode 100644
index 000000000000..db90e4f77a9a
--- /dev/null
+++ b/apps/services/bff/test/setupTestServer.ts
@@ -0,0 +1,8 @@
+import { testServer, TestServerOptions } from '@island.is/testing/nest'
+import { AppModule } from '../src/app/app.module'
+
+export const setupTestServer = async (options?: Partial<TestServerOptions>) =>
+  testServer({
+    appModule: AppModule,
+    ...options,
+  })
diff --git a/apps/services/bff/test/sharedConstants.ts b/apps/services/bff/test/sharedConstants.ts
new file mode 100644
index 000000000000..99ec6d196209
--- /dev/null
+++ b/apps/services/bff/test/sharedConstants.ts
@@ -0,0 +1,53 @@
+import jwt from 'jsonwebtoken'
+import {
+  TokenResponse,
+  GetLoginSearchParamsReturnValue,
+} from '../src/app/modules/ids/ids.types'
+
+export const SESSION_COOKIE_NAME = 'sid'
+export const ALGORITM_TYPE = 'HS256'
+export const SID_VALUE = 'fake_uuid'
+
+const ONE_HOUR_EXPIRATION = Math.floor(Date.now() / 1000) + 3600
+
+export const mockedTokensResponse: TokenResponse = {
+  access_token: jwt.sign(
+    {
+      exp: ONE_HOUR_EXPIRATION,
+    },
+    'mockSecret',
+    { algorithm: ALGORITM_TYPE },
+  ),
+  id_token: jwt.sign(
+    {
+      iss: 'https://example.com',
+      sub: '1234567890',
+      exp: ONE_HOUR_EXPIRATION,
+      sid: SID_VALUE,
+    },
+    'mockSecret',
+    { algorithm: ALGORITM_TYPE },
+  ),
+  refresh_token: 'mockRefreshToken1234567890',
+  scope: 'openid profile email',
+  token_type: 'Bearer',
+  expires_in: 3600,
+}
+
+export const getLoginSearchParmsFn = (args: {
+  sid: string
+  codeChallenge: string
+  loginHint?: string
+  prompt?: string
+}): GetLoginSearchParamsReturnValue => ({
+  client_id: '@test_client_id',
+  redirect_uri: 'http://localhost:3010/testclient/bff/callbacks/login',
+  response_type: 'code',
+  response_mode: 'query',
+  scope: 'test_scope offline_access openid profile',
+  state: SID_VALUE,
+  code_challenge: 'test_code_challenge',
+  code_challenge_method: 'test_code_challenge_method',
+  ...(args.loginHint && { login_hint: args.loginHint }),
+  ...(args.prompt && { prompt: args.prompt }),
+})
diff --git a/apps/services/bff/tsconfig.app.json b/apps/services/bff/tsconfig.app.json
new file mode 100644
index 000000000000..99bb983d6ee9
--- /dev/null
+++ b/apps/services/bff/tsconfig.app.json
@@ -0,0 +1,9 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "outDir": "../../../dist/out-tsc",
+    "types": ["node"]
+  },
+  "exclude": ["**/*.spec.ts", "**/*.test.ts", "**/test/**", "jest.config.ts,"],
+  "include": ["**/*.ts"]
+}
diff --git a/apps/services/bff/tsconfig.json b/apps/services/bff/tsconfig.json
new file mode 100644
index 000000000000..25873177db3f
--- /dev/null
+++ b/apps/services/bff/tsconfig.json
@@ -0,0 +1,13 @@
+{
+  "extends": "../../../tsconfig.base.json",
+  "files": [],
+  "include": [],
+  "references": [
+    {
+      "path": "./tsconfig.app.json"
+    },
+    {
+      "path": "./tsconfig.spec.json"
+    }
+  ]
+}
diff --git a/apps/services/bff/tsconfig.spec.json b/apps/services/bff/tsconfig.spec.json
new file mode 100644
index 000000000000..2068b86d4f4a
--- /dev/null
+++ b/apps/services/bff/tsconfig.spec.json
@@ -0,0 +1,9 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "outDir": "../../../dist/out-tsc",
+    "module": "commonjs",
+    "types": ["jest", "node"]
+  },
+  "include": ["**/*.spec.ts", "**/*.d.ts", "jest.config.ts"]
+}
diff --git a/charts/islandis/values.dev.yaml b/charts/islandis/values.dev.yaml
index 4d991db59816..345a86f5b2a9 100644
--- a/charts/islandis/values.dev.yaml
+++ b/charts/islandis/values.dev.yaml
@@ -418,6 +418,7 @@ api:
     - 'api-catalogue'
     - 'application-system'
     - 'consultation-portal'
+    - 'services-bff-portals-admin'
   grantNamespacesEnabled: true
   healthCheck:
     liveness:
@@ -1801,8 +1802,9 @@ portals-admin:
     SERVERSIDE_FEATURES_ON: ''
     SI_PUBLIC_ENVIRONMENT: 'dev'
     SI_PUBLIC_IDENTITY_SERVER_ISSUER_URL: 'https://identity-server.dev01.devland.is'
-  grantNamespaces: []
-  grantNamespacesEnabled: false
+  grantNamespaces:
+    - 'identity-server'
+  grantNamespacesEnabled: true
   healthCheck:
     liveness:
       initialDelaySeconds: 3
@@ -2279,6 +2281,89 @@ service-portal-api:
       eks.amazonaws.com/role-arn: 'arn:aws:iam::013313053092:role/service-portal-api'
     create: true
     name: 'service-portal-api'
+services-bff-portals-admin:
+  enabled: true
+  env:
+    BFF_ALLOWED_EXTERNAL_API_URLS: '["https://api.dev01.devland.is"]'
+    BFF_ALLOWED_REDIRECT_URIS: '["https://beta.dev01.devland.is"]'
+    BFF_CACHE_USER_PROFILE_TTL_MS: '3595000'
+    BFF_CALLBACKS_BASE_PATH: 'https://beta.dev01.devland.is/stjornbord/bff/callbacks'
+    BFF_CLIENT_BASE_URL: 'https://beta.dev01.devland.is'
+    BFF_CLIENT_KEY_PATH: '/stjornbord'
+    BFF_LOGIN_ATTEMPT_TTL_MS: '604800000'
+    BFF_LOGOUT_REDIRECT_URI: 'https://beta.dev01.devland.is'
+    BFF_NAME: 'stjornbord'
+    BFF_PAR_SUPPORT_ENABLED: 'true'
+    BFF_PROXY_API_ENDPOINT: 'http://web-api.islandis.svc.cluster.local/api/graphql'
+    IDENTITY_SERVER_CLIENT_ID: '@admin.island.is/bff-stjornbord'
+    IDENTITY_SERVER_CLIENT_SCOPES: '["@admin.island.is/delegations","@admin.island.is/ads","@admin.island.is/regulations","@admin.island.is/regulations:manage","@admin.island.is/icelandic-names-registry","@admin.island.is/application-system:admin","@admin.island.is/application-system:institution","@admin.island.is/document-provider","@admin.island.is/auth","@admin.island.is/auth:admin","@admin.island.is/petitions","@admin.island.is/service-desk","@admin.island.is/ads:explicit","@admin.island.is/signature-collection:manage","@admin.island.is/signature-collection:process","@admin.island.is/form-system","@admin.island.is/form-system:admin","@admin.island.is/delegation-system","@admin.island.is/delegation-system:admin"]'
+    IDENTITY_SERVER_ISSUER_URL: 'https://identity-server.dev01.devland.is'
+    LOG_LEVEL: 'info'
+    NODE_OPTIONS: '--max-old-space-size=460 -r dd-trace/init'
+    REDIS_URL_NODE_01: '["clustercfg.general-redis-cluster-group.5fzau3.euw1.cache.amazonaws.com:6379"]'
+    SERVERSIDE_FEATURES_ON: ''
+  grantNamespaces:
+    - 'identity-server'
+  grantNamespacesEnabled: true
+  healthCheck:
+    liveness:
+      initialDelaySeconds: 3
+      path: '/stjornbord/bff/liveness'
+      timeoutSeconds: 3
+    readiness:
+      initialDelaySeconds: 3
+      path: '/stjornbord/bff/health/check'
+      timeoutSeconds: 3
+  hpa:
+    scaling:
+      metric:
+        cpuAverageUtilization: 90
+        nginxRequestsIrate: 5
+      replicas:
+        max: 10
+        min: 2
+  image:
+    repository: '821090935708.dkr.ecr.eu-west-1.amazonaws.com/services-bff'
+  ingress:
+    primary-alb:
+      annotations:
+        kubernetes.io/ingress.class: 'nginx-external-alb'
+        nginx.ingress.kubernetes.io/proxy-buffer-size: '8k'
+        nginx.ingress.kubernetes.io/proxy-buffering: 'on'
+        nginx.ingress.kubernetes.io/service-upstream: 'true'
+      hosts:
+        - host: 'beta.dev01.devland.is'
+          paths:
+            - '/stjornbord/bff'
+  namespace: 'portals-admin'
+  podDisruptionBudget:
+    maxUnavailable: 1
+  podSecurityContext:
+    fsGroup: 65534
+  pvcs: []
+  replicaCount:
+    default: 2
+    max: 10
+    min: 2
+  resources:
+    limits:
+      cpu: '400m'
+      memory: '512Mi'
+    requests:
+      cpu: '100m'
+      memory: '256Mi'
+  secrets:
+    BFF_TOKEN_SECRET_BASE64: '/k8s/services-bff/portals-admin/BFF_TOKEN_SECRET_BASE64'
+    CONFIGCAT_SDK_KEY: '/k8s/configcat/CONFIGCAT_SDK_KEY'
+    IDENTITY_SERVER_CLIENT_SECRET: '/k8s/services-bff/portals-admin/IDENTITY_SERVER_CLIENT_SECRET'
+  securityContext:
+    allowPrivilegeEscalation: false
+    privileged: false
+  serviceAccount:
+    annotations:
+      eks.amazonaws.com/role-arn: 'arn:aws:iam::013313053092:role/services-bff'
+    create: true
+    name: 'services-bff'
 services-documents:
   enabled: true
   env:
diff --git a/charts/islandis/values.prod.yaml b/charts/islandis/values.prod.yaml
index 80a445eaacc4..102030c1ca5b 100644
--- a/charts/islandis/values.prod.yaml
+++ b/charts/islandis/values.prod.yaml
@@ -406,6 +406,7 @@ api:
     - 'api-catalogue'
     - 'application-system'
     - 'consultation-portal'
+    - 'services-bff-portals-admin'
   grantNamespacesEnabled: true
   healthCheck:
     liveness:
@@ -1666,8 +1667,9 @@ portals-admin:
     SERVERSIDE_FEATURES_ON: 'driving-license-use-v1-endpoint-for-v2-comms'
     SI_PUBLIC_ENVIRONMENT: 'prod'
     SI_PUBLIC_IDENTITY_SERVER_ISSUER_URL: 'https://innskra.island.is'
-  grantNamespaces: []
-  grantNamespacesEnabled: false
+  grantNamespaces:
+    - 'identity-server'
+  grantNamespacesEnabled: true
   healthCheck:
     liveness:
       initialDelaySeconds: 3
@@ -2149,6 +2151,92 @@ service-portal-api:
       eks.amazonaws.com/role-arn: 'arn:aws:iam::251502586493:role/service-portal-api'
     create: true
     name: 'service-portal-api'
+services-bff-portals-admin:
+  enabled: true
+  env:
+    BFF_ALLOWED_EXTERNAL_API_URLS: '["https://api.island.is"]'
+    BFF_ALLOWED_REDIRECT_URIS: 'https://island.is'
+    BFF_CACHE_USER_PROFILE_TTL_MS: '3595000'
+    BFF_CALLBACKS_BASE_PATH: 'https://island.is/stjornbord/bff/callbacks'
+    BFF_CLIENT_BASE_URL: 'https://island.is'
+    BFF_CLIENT_KEY_PATH: '/stjornbord'
+    BFF_LOGIN_ATTEMPT_TTL_MS: '604800000'
+    BFF_LOGOUT_REDIRECT_URI: 'https://island.is'
+    BFF_NAME: 'stjornbord'
+    BFF_PAR_SUPPORT_ENABLED: 'true'
+    BFF_PROXY_API_ENDPOINT: 'http://web-api.islandis.svc.cluster.local/api/graphql'
+    IDENTITY_SERVER_CLIENT_ID: '@admin.island.is/bff-stjornbord'
+    IDENTITY_SERVER_CLIENT_SCOPES: '["@admin.island.is/delegations","@admin.island.is/ads","@admin.island.is/regulations","@admin.island.is/regulations:manage","@admin.island.is/icelandic-names-registry","@admin.island.is/application-system:admin","@admin.island.is/application-system:institution","@admin.island.is/document-provider","@admin.island.is/auth","@admin.island.is/auth:admin","@admin.island.is/petitions","@admin.island.is/service-desk","@admin.island.is/ads:explicit","@admin.island.is/signature-collection:manage","@admin.island.is/signature-collection:process","@admin.island.is/form-system","@admin.island.is/form-system:admin","@admin.island.is/delegation-system","@admin.island.is/delegation-system:admin"]'
+    IDENTITY_SERVER_ISSUER_URL: 'https://innskra.island.is'
+    LOG_LEVEL: 'info'
+    NODE_OPTIONS: '--max-old-space-size=460 -r dd-trace/init'
+    REDIS_URL_NODE_01: '["clustercfg.general-redis-cluster-group.whakos.euw1.cache.amazonaws.com:6379"]'
+    SERVERSIDE_FEATURES_ON: 'driving-license-use-v1-endpoint-for-v2-comms'
+  grantNamespaces:
+    - 'identity-server'
+  grantNamespacesEnabled: true
+  healthCheck:
+    liveness:
+      initialDelaySeconds: 3
+      path: '/stjornbord/bff/liveness'
+      timeoutSeconds: 3
+    readiness:
+      initialDelaySeconds: 3
+      path: '/stjornbord/bff/health/check'
+      timeoutSeconds: 3
+  hpa:
+    scaling:
+      metric:
+        cpuAverageUtilization: 90
+        nginxRequestsIrate: 5
+      replicas:
+        max: 10
+        min: 2
+  image:
+    repository: '821090935708.dkr.ecr.eu-west-1.amazonaws.com/services-bff'
+  ingress:
+    primary-alb:
+      annotations:
+        kubernetes.io/ingress.class: 'nginx-external-alb'
+        nginx.ingress.kubernetes.io/proxy-buffer-size: '8k'
+        nginx.ingress.kubernetes.io/proxy-buffering: 'on'
+        nginx.ingress.kubernetes.io/service-upstream: 'true'
+      hosts:
+        - host: 'island.is'
+          paths:
+            - '/stjornbord/bff'
+        - host: 'www.island.is'
+          paths:
+            - '/stjornbord/bff'
+  namespace: 'portals-admin'
+  podDisruptionBudget:
+    maxUnavailable: 1
+  podSecurityContext:
+    fsGroup: 65534
+  pvcs: []
+  replicaCount:
+    default: 2
+    max: 10
+    min: 2
+  resources:
+    limits:
+      cpu: '400m'
+      memory: '512Mi'
+    requests:
+      cpu: '100m'
+      memory: '256Mi'
+  secrets:
+    BFF_TOKEN_SECRET_BASE64: '/k8s/services-bff/portals-admin/BFF_TOKEN_SECRET_BASE64'
+    CONFIGCAT_SDK_KEY: '/k8s/configcat/CONFIGCAT_SDK_KEY'
+    IDENTITY_SERVER_CLIENT_SECRET: '/k8s/services-bff/portals-admin/IDENTITY_SERVER_CLIENT_SECRET'
+  securityContext:
+    allowPrivilegeEscalation: false
+    privileged: false
+  serviceAccount:
+    annotations:
+      eks.amazonaws.com/role-arn: 'arn:aws:iam::251502586493:role/services-bff'
+    create: true
+    name: 'services-bff'
 services-documents:
   enabled: true
   env:
diff --git a/charts/islandis/values.staging.yaml b/charts/islandis/values.staging.yaml
index 421a729b6969..a63f051a0618 100644
--- a/charts/islandis/values.staging.yaml
+++ b/charts/islandis/values.staging.yaml
@@ -418,6 +418,7 @@ api:
     - 'api-catalogue'
     - 'application-system'
     - 'consultation-portal'
+    - 'services-bff-portals-admin'
   grantNamespacesEnabled: true
   healthCheck:
     liveness:
@@ -1539,8 +1540,9 @@ portals-admin:
     SERVERSIDE_FEATURES_ON: ''
     SI_PUBLIC_ENVIRONMENT: 'staging'
     SI_PUBLIC_IDENTITY_SERVER_ISSUER_URL: 'https://identity-server.staging01.devland.is'
-  grantNamespaces: []
-  grantNamespacesEnabled: false
+  grantNamespaces:
+    - 'identity-server'
+  grantNamespacesEnabled: true
   healthCheck:
     liveness:
       initialDelaySeconds: 3
@@ -2017,6 +2019,90 @@ service-portal-api:
       eks.amazonaws.com/role-arn: 'arn:aws:iam::261174024191:role/service-portal-api'
     create: true
     name: 'service-portal-api'
+services-bff-portals-admin:
+  enabled: true
+  env:
+    BFF_ALLOWED_EXTERNAL_API_URLS: '["https://api.staging01.devland.is"]'
+    BFF_ALLOWED_REDIRECT_URIS: '["https://beta.staging01.devland.is"]'
+    BFF_CACHE_USER_PROFILE_TTL_MS: '3595000'
+    BFF_CALLBACKS_BASE_PATH: 'https://beta.staging01.devland.is/stjornbord/bff/callbacks'
+    BFF_CLIENT_BASE_URL: 'https://beta.staging01.devland.is'
+    BFF_CLIENT_KEY_PATH: '/stjornbord'
+    BFF_LOGIN_ATTEMPT_TTL_MS: '604800000'
+    BFF_LOGOUT_REDIRECT_URI: 'https://beta.staging01.devland.is'
+    BFF_NAME: 'stjornbord'
+    BFF_PAR_SUPPORT_ENABLED: 'true'
+    BFF_PROXY_API_ENDPOINT: 'http://web-api.islandis.svc.cluster.local/api/graphql'
+    IDENTITY_SERVER_CLIENT_ID: '@admin.island.is/bff-stjornbord'
+    IDENTITY_SERVER_CLIENT_SCOPES: '["@admin.island.is/delegations","@admin.island.is/ads","@admin.island.is/regulations","@admin.island.is/regulations:manage","@admin.island.is/icelandic-names-registry","@admin.island.is/application-system:admin","@admin.island.is/application-system:institution","@admin.island.is/document-provider","@admin.island.is/auth","@admin.island.is/auth:admin","@admin.island.is/petitions","@admin.island.is/service-desk","@admin.island.is/ads:explicit","@admin.island.is/signature-collection:manage","@admin.island.is/signature-collection:process","@admin.island.is/form-system","@admin.island.is/form-system:admin","@admin.island.is/delegation-system","@admin.island.is/delegation-system:admin"]'
+    IDENTITY_SERVER_ISSUER_URL: 'https://identity-server.staging01.devland.is'
+    LOG_LEVEL: 'info'
+    NODE_OPTIONS: '--max-old-space-size=460 -r dd-trace/init'
+    REDIS_URL_NODE_01: '["clustercfg.general-redis-cluster-group.ab9ckb.euw1.cache.amazonaws.com:6379"]'
+    SERVERSIDE_FEATURES_ON: ''
+  grantNamespaces:
+    - 'identity-server'
+  grantNamespacesEnabled: true
+  healthCheck:
+    liveness:
+      initialDelaySeconds: 3
+      path: '/stjornbord/bff/liveness'
+      timeoutSeconds: 3
+    readiness:
+      initialDelaySeconds: 3
+      path: '/stjornbord/bff/health/check'
+      timeoutSeconds: 3
+  hpa:
+    scaling:
+      metric:
+        cpuAverageUtilization: 90
+        nginxRequestsIrate: 5
+      replicas:
+        max: 10
+        min: 2
+  image:
+    repository: '821090935708.dkr.ecr.eu-west-1.amazonaws.com/services-bff'
+  ingress:
+    primary-alb:
+      annotations:
+        kubernetes.io/ingress.class: 'nginx-external-alb'
+        nginx.ingress.kubernetes.io/enable-global-auth: 'false'
+        nginx.ingress.kubernetes.io/proxy-buffer-size: '8k'
+        nginx.ingress.kubernetes.io/proxy-buffering: 'on'
+        nginx.ingress.kubernetes.io/service-upstream: 'true'
+      hosts:
+        - host: 'beta.staging01.devland.is'
+          paths:
+            - '/stjornbord/bff'
+  namespace: 'portals-admin'
+  podDisruptionBudget:
+    maxUnavailable: 1
+  podSecurityContext:
+    fsGroup: 65534
+  pvcs: []
+  replicaCount:
+    default: 2
+    max: 10
+    min: 2
+  resources:
+    limits:
+      cpu: '400m'
+      memory: '512Mi'
+    requests:
+      cpu: '100m'
+      memory: '256Mi'
+  secrets:
+    BFF_TOKEN_SECRET_BASE64: '/k8s/services-bff/portals-admin/BFF_TOKEN_SECRET_BASE64'
+    CONFIGCAT_SDK_KEY: '/k8s/configcat/CONFIGCAT_SDK_KEY'
+    IDENTITY_SERVER_CLIENT_SECRET: '/k8s/services-bff/portals-admin/IDENTITY_SERVER_CLIENT_SECRET'
+  securityContext:
+    allowPrivilegeEscalation: false
+    privileged: false
+  serviceAccount:
+    annotations:
+      eks.amazonaws.com/role-arn: 'arn:aws:iam::261174024191:role/services-bff'
+    create: true
+    name: 'services-bff'
 services-documents:
   enabled: true
   env:
diff --git a/infra/helm/Chart.yaml b/infra/helm/Chart.yaml
index 047a1ad4d13d..94d71d036217 100644
--- a/infra/helm/Chart.yaml
+++ b/infra/helm/Chart.yaml
@@ -158,5 +158,9 @@ dependencies:
     repository: file://libs/api-template
     version: 0.0.1
     alias: services-university-gateway-worker
+  - name: api-template
+    repository: file://libs/api-template
+    version: 0.0.1
+    alias: services-bff
 type: application
 version: 0.0.9
diff --git a/infra/package.json b/infra/package.json
index db86f28487b8..bf6322a2da85 100644
--- a/infra/package.json
+++ b/infra/package.json
@@ -30,6 +30,8 @@
     "aws-sdk": "^2.1003.0",
     "glob": "10.3.3",
     "js-yaml": "4.0.0",
+    "json-refs": "3.0.15",
+    "json-schema-to-zod": "2.4.1",
     "lodash": "4.17.21",
     "yargs": "17.7.2"
   },
diff --git a/infra/src/cli/cli.ts b/infra/src/cli/cli.ts
index 3abc1c808dc9..b806dcecdd97 100644
--- a/infra/src/cli/cli.ts
+++ b/infra/src/cli/cli.ts
@@ -83,15 +83,13 @@ const cli = yargs(process.argv.slice(2))
       )
     },
     async (argv) => {
-      const services = await renderLocalServices({
+      await renderLocalServices({
         services: argv.services,
         dryRun: argv.dry,
         json: argv.json,
         print: true,
         noUpdateSecrets: argv['no-update-secrets'],
       })
-
-      return
     },
   )
   .command(
@@ -131,7 +129,7 @@ const cli = yargs(process.argv.slice(2))
           })
       )
     },
-    async (argv) =>
+    async (argv) => {
       await runLocalServices(argv.services, argv.dependencies, {
         dryRun: argv.dry,
         json: argv.json,
@@ -139,7 +137,8 @@ const cli = yargs(process.argv.slice(2))
         noUpdateSecrets: argv['no-update-secrets'],
         print: argv.print,
         startProxies: argv.proxies,
-      }),
+      })
+    },
   )
   .demandCommand(1)
   .parse()
diff --git a/infra/src/cli/render-local-mocks.ts b/infra/src/cli/render-local-mocks.ts
index 97a14e4cdf01..9c328c497217 100644
--- a/infra/src/cli/render-local-mocks.ts
+++ b/infra/src/cli/render-local-mocks.ts
@@ -87,7 +87,7 @@ export async function runLocalServices(
     noUpdateSecrets,
   })
 
-  // Verify tat all dependencies exist in the rendered dependency list
+  // Verify that all dependencies exist in the rendered dependency list
   for (const dependency of dependencies) {
     if (!renderedLocalServices.services[dependency]) {
       throw new Error(`Dependency ${dependency} not found`)
diff --git a/infra/src/dsl/adapters/get-ssm-params.ts b/infra/src/dsl/adapters/get-ssm-params.ts
index da57630634e5..d44e255ff07c 100644
--- a/infra/src/dsl/adapters/get-ssm-params.ts
+++ b/infra/src/dsl/adapters/get-ssm-params.ts
@@ -20,7 +20,7 @@ export async function getSsmParams(
     chunks.map((Names) =>
       client.getParameters({ Names, WithDecryption: true }),
     ),
-  )
+  ).catch(handleCredentialsProviderError)
   const params = allParams
     .map(({ Parameters }) =>
       Object.fromEntries(Parameters!.map((p) => [p.Name, p.Value])),
@@ -35,3 +35,13 @@ export async function getSsmParams(
   })
   return params
 }
+
+function handleCredentialsProviderError(err: Error): never {
+  if (err.name === 'CredentialsProviderError') {
+    console.error(
+      'Could not load AWS credentials from any providers. Did you forget to configure environment variables, aws profile or run `aws sso login`?',
+    )
+    process.exit(1)
+  }
+  throw err
+}
diff --git a/infra/src/dsl/bff.ts b/infra/src/dsl/bff.ts
new file mode 100644
index 000000000000..95b05e5f3b03
--- /dev/null
+++ b/infra/src/dsl/bff.ts
@@ -0,0 +1,83 @@
+import { json, ref } from './dsl'
+import { BffInfo, Context, PortalKeys } from './types/input-types'
+
+import {
+  adminPortalScopes,
+  servicePortalScopes,
+} from '../../../libs/auth/scopes/src/index'
+
+export const getScopes = (key: PortalKeys) => {
+  switch (key) {
+    case 'minarsidur':
+      return servicePortalScopes
+    case 'stjornbord':
+      return adminPortalScopes
+    default:
+      throw new Error('Invalid BFF client')
+  }
+}
+
+export const bffConfig = ({ key, services, clientName, clientId }: BffInfo) => {
+  const getBaseUrl = (ctx: Context) =>
+    ctx.featureDeploymentName
+      ? `${ctx.featureDeploymentName}-beta.${ctx.env.domain}`
+      : ctx.env.type === 'prod'
+      ? ctx.env.domain
+      : `beta.${ctx.env.domain}`
+
+  return {
+    env: {
+      IDENTITY_SERVER_CLIENT_SCOPES: json(getScopes(key)),
+      IDENTITY_SERVER_CLIENT_ID: clientId,
+      IDENTITY_SERVER_ISSUER_URL: {
+        dev: 'https://identity-server.dev01.devland.is',
+        staging: 'https://identity-server.staging01.devland.is',
+        prod: 'https://innskra.island.is',
+      },
+      BFF_NAME: {
+        local: key,
+        dev: key,
+        staging: key,
+        prod: key,
+      },
+      BFF_CLIENT_KEY_PATH: `/${key}`,
+      BFF_PAR_SUPPORT_ENABLED: 'true',
+      BFF_CLIENT_BASE_URL: {
+        local: 'http://localhost:4200',
+        dev: ref((ctx) => ctx.svc(`https://${getBaseUrl(ctx)}`)),
+        staging: ref((ctx) => ctx.svc(`https://${getBaseUrl(ctx)}`)),
+        prod: 'https://island.is',
+      },
+      BFF_ALLOWED_REDIRECT_URIS: {
+        local: json([`http://localhost:4200/${key}`]),
+        dev: ref((ctx) => json([`https://${getBaseUrl(ctx)}`])),
+        staging: ref((ctx) => json([`https://${getBaseUrl(ctx)}`])),
+        prod: 'https://island.is',
+      },
+      BFF_LOGOUT_REDIRECT_URI: {
+        local: `http://localhost:4200/${key}`,
+        dev: ref((ctx) => `https://${getBaseUrl(ctx)}`),
+        staging: ref((ctx) => `https://${getBaseUrl(ctx)}`),
+        prod: 'https://island.is',
+      },
+      BFF_CALLBACKS_BASE_PATH: {
+        local: `http://localhost:3010/${key}/bff/callbacks`,
+        dev: ref((c) => `https://${getBaseUrl(c)}/${key}/bff/callbacks`),
+        staging: ref((c) => `https://${getBaseUrl(c)}/${key}/bff/callbacks`),
+        prod: ref((c) => `https://${getBaseUrl(c)}/${key}/bff/callbacks`),
+      },
+      BFF_PROXY_API_ENDPOINT: {
+        local: 'http://localhost:4444/api/graphql',
+        dev: ref((ctx) => `http://${ctx.svc(services.api)}/api/graphql`),
+        staging: ref((ctx) => `http://${ctx.svc(services.api)}/api/graphql`),
+        prod: ref((ctx) => `http://${ctx.svc(services.api)}/api/graphql`),
+      },
+      BFF_CACHE_USER_PROFILE_TTL_MS: (60 * 60 * 1000 - 5000).toString(),
+      BFF_LOGIN_ATTEMPT_TTL_MS: (60 * 60 * 1000 * 24 * 7).toString(),
+    },
+    secrets: {
+      BFF_TOKEN_SECRET_BASE64: `/k8s/services-bff/${clientName}/BFF_TOKEN_SECRET_BASE64`,
+      IDENTITY_SERVER_CLIENT_SECRET: `/k8s/services-bff/${clientName}/IDENTITY_SERVER_CLIENT_SECRET`,
+    },
+  }
+}
diff --git a/infra/src/dsl/dsl.ts b/infra/src/dsl/dsl.ts
index b56a0c9125df..0427e7f0e29d 100644
--- a/infra/src/dsl/dsl.ts
+++ b/infra/src/dsl/dsl.ts
@@ -5,7 +5,6 @@ import {
   ExtraValues,
   Features,
   HealthProbe,
-  Ingress,
   InitContainers,
   MountedFile,
   PersistentVolumeClaim,
@@ -18,7 +17,9 @@ import {
   XroadConfig,
   PodDisruptionBudget,
   IngressMapping,
+  BffInfo,
 } from './types/input-types'
+import { bffConfig } from './bff'
 import { logger } from '../logging'
 import { COMMON_SECRETS } from './consts'
 
@@ -184,6 +185,15 @@ export class ServiceBuilder<ServiceType extends string> {
     return this
   }
 
+  bff(config: BffInfo) {
+    this.serviceDef.env = { ...bffConfig(config).env, ...this.serviceDef.env }
+    this.serviceDef.secrets = {
+      ...bffConfig(config).secrets,
+      ...this.serviceDef.secrets,
+    }
+    return this
+  }
+
   /**
    * X-Road configuration blocks to inject to the container. Types of XroadConfig can contain environment variables and/or secrets that define how to contact an external service through X-Road.
    * @param ...configs - X-road configs
@@ -337,7 +347,7 @@ export class ServiceBuilder<ServiceType extends string> {
   /**
    * Initializes a container with optional parameters and checks for unique container names.
    * If the 'withDB' flag is set or if the 'postgres' property is present in the input object,
-   * it grants database access to the container.
+   * it grants database access toethe container.
    * Maps to a Pod specification for an [initContainer](https://kubernetes.io/docs/concepts/workloads/pods/init-containers/).
    *
    * @param ic - The initial container configuration.
diff --git a/infra/src/dsl/feature-values.spec.ts b/infra/src/dsl/feature-values.spec.ts
index 9ee13cb2f03d..d9b72b3d3f03 100644
--- a/infra/src/dsl/feature-values.spec.ts
+++ b/infra/src/dsl/feature-values.spec.ts
@@ -1,17 +1,18 @@
-import { ServiceBuilder, ref, service } from './dsl'
+import { getScopes } from './bff'
+import { ServiceBuilder, json, ref, service } from './dsl'
+import { getFeatureAffectedServices } from './feature-deployments'
 import { Kubernetes } from './kubernetes-runtime'
+import { generateOutput } from './processing/rendering-pipeline'
 import { EnvironmentConfig } from './types/charts'
-import { getFeatureAffectedServices } from './feature-deployments'
 import { HelmValueFile } from './types/output-types'
-import { getHelmValueFile } from './value-files-generators/helm-value-file'
 import { renderers } from './upstream-dependencies'
-import { generateOutput } from './processing/rendering-pipeline'
+import { getHelmValueFile } from './value-files-generators/helm-value-file'
 
 const getEnvironment = (
   options: EnvironmentConfig = {
     auroraHost: 'a',
     redisHost: 'b',
-    domain: 'staging01.devland.is',
+    domain: 'dev01.devland.is',
     type: 'dev',
     featuresOn: [],
     defaultMaxReplicas: 3,
@@ -49,8 +50,7 @@ describe('Feature-deployment support', () => {
     const dependencyA = service('service-a').namespace('A')
     const dependencyB = service('service-b')
     const dependencyC = service('service-c')
-
-    const apiService = service('graphql')
+    const apiService = service('api')
       .env({
         A: ref((h) => `${h.svc(dependencyA)}`),
         B: ref(
@@ -76,10 +76,26 @@ describe('Feature-deployment support', () => {
       })
       .db()
 
+    const bff = service('services-bff-portals-admin')
+      .bff({
+        key: 'stjornbord',
+        clientId: '@admin.island.is/bff-stjornbord',
+        clientName: 'portals-admin',
+        services: { api: apiService },
+      })
+      .env({
+        BFF_ALLOWED_EXTERNAL_API_URLS: {
+          local: json(['http://localhost:3377/download/v1']),
+          dev: json(['https://api.dev01.devland.is']),
+          staging: json(['https://api.staging01.devland.is']),
+          prod: json(['https://api.island.is']),
+        },
+      })
+      .redis()
     dev = getEnvironment()
     const services1 = await getFeatureAffectedServices(
-      [apiService, dependencyA, dependencyB],
-      [dependencyA, dependencyC],
+      [apiService, dependencyA, dependencyB, bff],
+      [dependencyA, dependencyC, bff],
       [dependencyC],
       dev,
     )
@@ -87,11 +103,11 @@ describe('Feature-deployment support', () => {
   })
 
   it('dynamic service name generation', () => {
-    expect(values.services.graphql.env).toEqual({
+    expect(values.services.api.env).toEqual({
       A: 'web-service-a',
       B: 'feature-web-service-b.islandis.svc.cluster.local',
-      DB_USER: 'feature_feature_A_graphql',
-      DB_NAME: 'feature_feature_A_graphql',
+      DB_USER: 'feature_feature_A_api',
+      DB_NAME: 'feature_feature_A_api',
       DB_HOST: 'a',
       DB_REPLICAS_HOST: 'a',
       NODE_OPTIONS: '--max-old-space-size=230 -r dd-trace/init',
@@ -100,8 +116,32 @@ describe('Feature-deployment support', () => {
       DB_EXTENSIONS: 'foo',
     })
   })
+  it('bff feature env urls', () => {
+    expect(values.services['services-bff-portals-admin'].env).toEqual({
+      IDENTITY_SERVER_CLIENT_SCOPES: json(getScopes('stjornbord')),
+      IDENTITY_SERVER_CLIENT_ID: `@admin.island.is/bff-stjornbord`,
+      IDENTITY_SERVER_ISSUER_URL: 'https://identity-server.dev01.devland.is',
+      BFF_NAME: 'stjornbord',
+      BFF_CLIENT_KEY_PATH: `/stjornbord`,
+      BFF_PAR_SUPPORT_ENABLED: 'true',
+      BFF_ALLOWED_REDIRECT_URIS: json([
+        'https://feature-A-beta.dev01.devland.is',
+      ]),
+      BFF_CLIENT_BASE_URL: 'https://feature-A-beta.dev01.devland.is',
+      BFF_LOGOUT_REDIRECT_URI: 'https://feature-A-beta.dev01.devland.is',
+      BFF_CALLBACKS_BASE_PATH: `https://feature-A-beta.dev01.devland.is/stjornbord/bff/callbacks`,
+      BFF_PROXY_API_ENDPOINT: 'http://web-api/api/graphql',
+      BFF_ALLOWED_EXTERNAL_API_URLS: json(['https://api.dev01.devland.is']),
+      BFF_CACHE_USER_PROFILE_TTL_MS: '3595000',
+      BFF_LOGIN_ATTEMPT_TTL_MS: '604800000',
+      NODE_OPTIONS: '--max-old-space-size=230 -r dd-trace/init',
+      SERVERSIDE_FEATURES_ON: '',
+      LOG_LEVEL: 'info',
+      REDIS_URL_NODE_01: 'b',
+    })
+  })
   it('db extensions are set', () => {
-    expect(values.services.graphql.initContainer?.env).toEqual(
+    expect(values.services.api.initContainer?.env).toEqual(
       expect.objectContaining({
         DB_EXTENSIONS: 'foo',
       }),
@@ -109,27 +149,27 @@ describe('Feature-deployment support', () => {
   })
 
   it('dynamic secrets path', () => {
-    expect(values.services.graphql.secrets).toHaveProperty('DB_PASS')
-    expect(values.services.graphql.secrets!.DB_PASS).toEqual(
-      '/k8s/feature-feature-A-graphql/DB_PASSWORD',
+    expect(values.services.api.secrets).toHaveProperty('DB_PASS')
+    expect(values.services.api.secrets!.DB_PASS).toEqual(
+      '/k8s/feature-feature-A-api/DB_PASSWORD',
     )
   })
 
   it('dynamic secrets path', () => {
-    expect(values.services.graphql.initContainer?.secrets).toHaveProperty(
-      'DB_PASS',
-    )
-    expect(values.services.graphql.initContainer?.secrets!.DB_PASS).toEqual(
-      '/k8s/feature-feature-A-graphql/DB_PASSWORD',
+    expect(values.services.api.initContainer?.secrets).toHaveProperty('DB_PASS')
+    expect(values.services.api.initContainer?.secrets!.DB_PASS).toEqual(
+      '/k8s/feature-feature-A-api/DB_PASSWORD',
     )
   })
 
   it('feature deployment namespaces', () => {
     expect(Object.keys(values.services).sort()).toEqual([
-      'graphql',
+      'api',
       'service-a',
+      'services-bff-portals-admin',
     ])
-    expect(values.services['graphql'].namespace).toEqual(
+    expect(values.services['api'].namespace).toEqual(`feature-${dev.feature}`)
+    expect(values.services['services-bff-portals-admin'].namespace).toEqual(
       `feature-${dev.feature}`,
     )
     expect(values.services['service-a'].namespace).toEqual(
@@ -138,7 +178,7 @@ describe('Feature-deployment support', () => {
   })
 
   it('feature deployment ingress', () => {
-    expect(values.services.graphql.ingress).toEqual({
+    expect(values.services.api.ingress).toEqual({
       'primary-alb': {
         annotations: {
           'kubernetes.io/ingress.class': 'nginx-external-alb',
@@ -146,7 +186,7 @@ describe('Feature-deployment support', () => {
         },
         hosts: [
           {
-            host: 'feature-A-a.staging01.devland.is',
+            host: 'feature-A-a.dev01.devland.is',
             paths: ['/'],
           },
         ],
diff --git a/infra/src/dsl/portal-env.spec.ts b/infra/src/dsl/portal-env.spec.ts
new file mode 100644
index 000000000000..fe20cab1fd80
--- /dev/null
+++ b/infra/src/dsl/portal-env.spec.ts
@@ -0,0 +1,238 @@
+import { json, service } from './dsl'
+import { Kubernetes } from './kubernetes-runtime'
+import { generateOutputOne } from './processing/rendering-pipeline'
+import { EnvironmentConfig } from './types/charts'
+import { HelmService, SerializeSuccess } from './types/output-types'
+import { renderers } from './upstream-dependencies'
+
+import { adminPortalScopes } from '../../../libs/auth/scopes/src/index'
+
+import { FIVE_SECONDS_IN_MS } from '../../../apps/services/bff/src/app/constants/time'
+const ONE_HOUR_IN_MS = 60 * 60 * 1000
+const ONE_WEEK_IN_MS = ONE_HOUR_IN_MS * 24 * 7
+
+const bffName = 'services-bff'
+const clientName = 'portals-admin'
+const serviceName = `${bffName}-${clientName}`
+const key = 'stjornbord'
+
+const Dev: EnvironmentConfig = {
+  auroraHost: 'a',
+  redisHost: 'b',
+  domain: 'dev01.devland.is',
+  type: 'dev',
+  featuresOn: [],
+  defaultMaxReplicas: 3,
+  defaultMinReplicas: 2,
+  releaseName: 'web',
+  awsAccountId: '111111',
+  awsAccountRegion: 'eu-west-1',
+  global: {},
+}
+
+const services = {
+  api: service('api'),
+}
+
+describe('BFF PortalEnv serialization', () => {
+  const services = { api: service('api') }
+  const sut = service(serviceName)
+    .namespace(clientName)
+    .image(bffName)
+    .redis()
+    .serviceAccount(bffName)
+    .env({
+      BFF_ALLOWED_EXTERNAL_API_URLS: {
+        local: json(['http://localhost:3377/download/v1']),
+        dev: json(['https://api.dev01.devland.is']),
+        staging: json(['https://api.staging01.devland.is']),
+        prod: json(['https://api.island.is']),
+      },
+    })
+    .bff({
+      key: 'stjornbord',
+      clientId: `@admin.island.is/bff-stjornbord`,
+      clientName,
+      services,
+    })
+    .command('node')
+    .args('main.js')
+    .readiness(`/${key}/bff/health/check`)
+    .liveness(`/${key}/bff/liveness`)
+    .replicaCount({
+      default: 2,
+      min: 2,
+      max: 3,
+    })
+    .resources({
+      limits: {
+        cpu: '400m',
+        memory: '512Mi',
+      },
+      requests: {
+        cpu: '100m',
+        memory: '256Mi',
+      },
+    })
+    .ingress({
+      primary: {
+        host: {
+          dev: ['beta'],
+          staging: ['beta'],
+          prod: ['', 'www.island.is'],
+        },
+        extraAnnotations: {
+          dev: {
+            'nginx.ingress.kubernetes.io/proxy-buffering': 'on',
+            'nginx.ingress.kubernetes.io/proxy-buffer-size': '8k',
+          },
+          staging: {
+            'nginx.ingress.kubernetes.io/enable-global-auth': 'false',
+            'nginx.ingress.kubernetes.io/proxy-buffering': 'on',
+            'nginx.ingress.kubernetes.io/proxy-buffer-size': '8k',
+          },
+          prod: {
+            'nginx.ingress.kubernetes.io/proxy-buffering': 'on',
+            'nginx.ingress.kubernetes.io/proxy-buffer-size': '8k',
+          },
+        },
+        paths: [`/${key}/bff`],
+      },
+    })
+  let result: SerializeSuccess<HelmService>
+  beforeEach(async () => {
+    result = (await generateOutputOne({
+      outputFormat: renderers.helm,
+      service: sut,
+      runtime: new Kubernetes(Dev),
+      env: Dev,
+    })) as SerializeSuccess<HelmService>
+  })
+
+  it('basic props', () => {
+    expect(result.serviceDef[0].enabled).toBe(true)
+    expect(result.serviceDef[0].namespace).toBe(clientName)
+  })
+
+  it('image and repo', () => {
+    expect(result.serviceDef[0].image.repository).toBe(
+      `821090935708.dkr.ecr.eu-west-1.amazonaws.com/${bffName}`,
+    )
+  })
+
+  it('command and args', () => {
+    expect(result.serviceDef[0].command).toStrictEqual(['node'])
+    expect(result.serviceDef[0].args).toStrictEqual(['main.js'])
+  })
+  it('network policies', () => {
+    expect(result.serviceDef[0].grantNamespaces).toStrictEqual([])
+    expect(result.serviceDef[0].grantNamespacesEnabled).toBe(false)
+  })
+
+  it('resources', () => {
+    expect(result.serviceDef[0].resources).toStrictEqual({
+      limits: {
+        cpu: '400m',
+        memory: '512Mi',
+      },
+      requests: {
+        cpu: '100m',
+        memory: '256Mi',
+      },
+    })
+  })
+  it('replica count', () => {
+    expect(result.serviceDef[0].replicaCount).toStrictEqual({
+      min: 2,
+      max: 3,
+      default: 2,
+    })
+  })
+
+  it('environment variables', () => {
+    expect(result.serviceDef[0].env).toEqual({
+      IDENTITY_SERVER_CLIENT_SCOPES: json(adminPortalScopes),
+      IDENTITY_SERVER_CLIENT_ID: `@admin.island.is/bff-${key}`,
+      IDENTITY_SERVER_ISSUER_URL: 'https://identity-server.dev01.devland.is',
+      // BFF
+      BFF_NAME: 'stjornbord',
+      BFF_CLIENT_KEY_PATH: `/${key}`,
+      BFF_PAR_SUPPORT_ENABLED: 'true',
+      BFF_ALLOWED_REDIRECT_URIS: json(['https://beta.dev01.devland.is']),
+      BFF_CLIENT_BASE_URL: 'https://beta.dev01.devland.is',
+      BFF_LOGOUT_REDIRECT_URI: 'https://beta.dev01.devland.is',
+      BFF_CALLBACKS_BASE_PATH: `https://beta.dev01.devland.is/${key}/bff/callbacks`,
+      BFF_PROXY_API_ENDPOINT:
+        'http://web-api.islandis.svc.cluster.local/api/graphql',
+      BFF_ALLOWED_EXTERNAL_API_URLS: json(['https://api.dev01.devland.is']),
+      BFF_CACHE_USER_PROFILE_TTL_MS: (
+        ONE_HOUR_IN_MS - FIVE_SECONDS_IN_MS
+      ).toString(),
+      BFF_LOGIN_ATTEMPT_TTL_MS: ONE_WEEK_IN_MS.toString(),
+      NODE_OPTIONS: '--max-old-space-size=460 -r dd-trace/init',
+      SERVERSIDE_FEATURES_ON: '',
+      LOG_LEVEL: 'info',
+      REDIS_URL_NODE_01: 'b',
+    })
+  })
+
+  it('secrets', () => {
+    expect(result.serviceDef[0].secrets).toEqual({
+      BFF_TOKEN_SECRET_BASE64: `/k8s/${bffName}/${clientName}/BFF_TOKEN_SECRET_BASE64`,
+      IDENTITY_SERVER_CLIENT_SECRET: `/k8s/${bffName}/${clientName}/IDENTITY_SERVER_CLIENT_SECRET`,
+      CONFIGCAT_SDK_KEY: '/k8s/configcat/CONFIGCAT_SDK_KEY',
+    })
+  })
+
+  it('service account', () => {
+    expect(result.serviceDef[0].podSecurityContext).toEqual({
+      fsGroup: 65534,
+    })
+    expect(result.serviceDef[0].serviceAccount).toEqual({
+      annotations: {
+        'eks.amazonaws.com/role-arn': `arn:aws:iam::111111:role/${bffName}`,
+      },
+      create: true,
+      name: bffName,
+    })
+  })
+
+  it('ingress', () => {
+    expect(result.serviceDef[0].ingress).toEqual({
+      'primary-alb': {
+        annotations: {
+          'nginx.ingress.kubernetes.io/proxy-buffering': 'on',
+          'nginx.ingress.kubernetes.io/proxy-buffer-size': '8k',
+          'kubernetes.io/ingress.class': 'nginx-external-alb',
+          'nginx.ingress.kubernetes.io/service-upstream': 'true',
+        },
+        hosts: [
+          {
+            host: 'beta.dev01.devland.is',
+            paths: ['/stjornbord/bff'],
+          },
+        ],
+      },
+    })
+  })
+})
+
+describe('Env definition defaults', () => {
+  const sut = service('api').namespace('islandis').image(bffName)
+  let result: SerializeSuccess<HelmService>
+  beforeEach(async () => {
+    result = (await generateOutputOne({
+      outputFormat: renderers.helm,
+      service: sut,
+      runtime: new Kubernetes(Dev),
+      env: Dev,
+    })) as SerializeSuccess<HelmService>
+  })
+  it('replica max count', () => {
+    expect(result.serviceDef[0].replicaCount).toStrictEqual({
+      min: 2,
+      max: 3,
+      default: 2,
+    })
+  })
+})
diff --git a/infra/src/dsl/service-to-environment/pre-process-service.ts b/infra/src/dsl/service-to-environment/pre-process-service.ts
index 6533fa196c6b..cf90cbb5cde9 100644
--- a/infra/src/dsl/service-to-environment/pre-process-service.ts
+++ b/infra/src/dsl/service-to-environment/pre-process-service.ts
@@ -335,7 +335,6 @@ function addFeaturesConfig(
       secrets: v.secrets,
     }
   })
-
   return {
     envs: featureEnvs.reduce(
       (acc, feature) => ({ ...acc, ...feature.envs }),
diff --git a/infra/src/dsl/types/input-types.ts b/infra/src/dsl/types/input-types.ts
index 43232dd01562..04b75ad4f20e 100644
--- a/infra/src/dsl/types/input-types.ts
+++ b/infra/src/dsl/types/input-types.ts
@@ -16,6 +16,16 @@ export type ValueSource = string | ((e: Context) => string)
 export type ValueType = MissingSettingType | ValueSource
 // See https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes for more info
 export type AccessModes = 'ReadWrite' | 'ReadOnly'
+
+export type BffInfo = {
+  key: PortalKeys
+  clientId: string
+  clientName: string
+  services: BffInfraServices
+  env?: EnvironmentVariables
+  secrets?: Secrets
+}
+
 export type PostgresInfo = {
   host?: {
     [env in OpsEnv]: string
@@ -79,6 +89,11 @@ export type Feature = {
 
 export type Features = { [name in FeatureNames]: Feature }
 export type MountedFile = { filename: string; env: string }
+export type PortalKeys = 'stjornbord' | 'minarsidur'
+
+export interface BffInfraServices {
+  api: ServiceBuilder<string> | string
+}
 
 export type ServiceDefinitionCore = {
   liveness: HealthProbe
diff --git a/infra/src/dsl/value-files-generators/local-setup.ts b/infra/src/dsl/value-files-generators/local-setup.ts
index 2770615a561e..4073157cebe8 100644
--- a/infra/src/dsl/value-files-generators/local-setup.ts
+++ b/infra/src/dsl/value-files-generators/local-setup.ts
@@ -16,6 +16,14 @@ const mapServiceToNXname = async (serviceName: string) => {
   const projects = globSync(['apps/*/project.json', 'apps/*/*/project.json'], {
     cwd: projectRootPath,
   })
+
+  // This is a hack to make sure we are running `services-bff` project with the desired infra config.
+  // We have multiple infra files under the `services-bff` project, e.g. `services-bff-admin-portal`, `services-bff-my-pages-portal`, etc.
+  // For the project to run correctly, we need to run the `services-bff` project.
+  if (serviceName.startsWith('services-bff-')) {
+    serviceName = 'services-bff'
+  }
+
   const nxName = (
     await Promise.all(
       projects.map(async (path) => {
@@ -69,6 +77,7 @@ export const getLocalrunValueFile = async (
       ? { PORT: runtime.ports[name].toString() }
       : {}
     const serviceNXName = await mapServiceToNXname(name)
+
     logger.debug('Process service', { name, service, serviceNXName })
     dockerComposeServices[name] = {
       env: Object.assign(
diff --git a/infra/src/feature-env.ts b/infra/src/feature-env.ts
index 790d98d4a190..678f02fdf490 100644
--- a/infra/src/feature-env.ts
+++ b/infra/src/feature-env.ts
@@ -18,7 +18,7 @@ import {
   renderHelmValueFileContent,
 } from './dsl/exports/helm'
 import { ServiceBuilder } from './dsl/dsl'
-import { logger } from './common'
+import { logger } from './logging'
 
 type ChartName = 'islandis' | 'identity-server'
 
diff --git a/infra/src/uber-charts/islandis.ts b/infra/src/uber-charts/islandis.ts
index 548a918b3613..28bd6f521aaa 100644
--- a/infra/src/uber-charts/islandis.ts
+++ b/infra/src/uber-charts/islandis.ts
@@ -10,10 +10,15 @@ import {
 } from '../../../apps/application-system/api/infra/application-system-api'
 import { serviceSetup as appSystemFormSetup } from '../../../apps/application-system/form/infra/application-system-form'
 
+// Portals
 import { serviceSetup as servicePortalApiSetup } from '../../../apps/services/user-profile/infra/service-portal-api'
 import { serviceSetup as servicePortalSetup } from '../../../apps/portals/my-pages/infra/portals-my-pages'
 
 import { serviceSetup as adminPortalSetup } from '../../../apps/portals/admin/infra/portals-admin'
+
+// Bff's
+import { serviceSetup as bffAdminPortalServiceSetup } from '../../../apps/services/bff/infra/admin-portal.infra'
+
 import { serviceSetup as consultationPortalSetup } from '../../../apps/consultation-portal/infra/samradsgatt'
 import { serviceSetup as xroadCollectorSetup } from '../../../apps/services/xroad-collector/infra/xroad-collector'
 
@@ -112,13 +117,15 @@ const api = apiSetup({
   universityGatewayApi: universityGatewayService,
   userNotificationService,
 })
+
 const servicePortal = servicePortalSetup({ graphql: api })
-const appSystemForm = appSystemFormSetup({ api: api })
-const web = webSetup({ api: api })
+const bffAdminPortalService = bffAdminPortalServiceSetup({ api })
+const appSystemForm = appSystemFormSetup({ api })
+const web = webSetup({ api })
 const searchIndexer = searchIndexerSetup()
 const contentfulEntryTagger = contentfulEntryTaggerSetup()
 const contentfulApps = contentfulAppsSetup()
-const consultationPortal = consultationPortalSetup({ api: api })
+const consultationPortal = consultationPortalSetup({ api })
 
 const xroadCollector = xroadCollectorSetup()
 
@@ -174,6 +181,7 @@ export const Services: EnvironmentServices = {
     universityGatewayWorker,
     contentfulApps,
     contentfulEntryTagger,
+    bffAdminPortalService,
   ],
   staging: [
     appSystemApi,
@@ -207,6 +215,7 @@ export const Services: EnvironmentServices = {
     sessionsCleanupWorker,
     universityGatewayService,
     universityGatewayWorker,
+    bffAdminPortalService,
   ],
   dev: [
     appSystemApi,
@@ -244,6 +253,7 @@ export const Services: EnvironmentServices = {
     contentfulApps,
     universityGatewayService,
     universityGatewayWorker,
+    bffAdminPortalService,
   ],
 }
 
diff --git a/infra/yarn.lock b/infra/yarn.lock
index c97ff807bf19..b8110816e3e0 100644
--- a/infra/yarn.lock
+++ b/infra/yarn.lock
@@ -4108,6 +4108,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"asap@npm:^2.0.0":
+  version: 2.0.6
+  resolution: "asap@npm:2.0.6"
+  checksum: b296c92c4b969e973260e47523207cd5769abd27c245a68c26dc7a0fe8053c55bb04360237cb51cab1df52be939da77150ace99ad331fb7fb13b3423ed73ff3d
+  languageName: node
+  linkType: hard
+
 "assign-symbols@npm:^1.0.0":
   version: 1.0.0
   resolution: "assign-symbols@npm:1.0.0"
@@ -4623,6 +4630,19 @@ __metadata:
   languageName: node
   linkType: hard
 
+"call-bind@npm:^1.0.7":
+  version: 1.0.7
+  resolution: "call-bind@npm:1.0.7"
+  dependencies:
+    es-define-property: ^1.0.0
+    es-errors: ^1.3.0
+    function-bind: ^1.1.2
+    get-intrinsic: ^1.2.4
+    set-function-length: ^1.2.1
+  checksum: 295c0c62b90dd6522e6db3b0ab1ce26bdf9e7404215bda13cfee25b626b5ff1a7761324d58d38b1ef1607fc65aca2d06e44d2e18d0dfc6c14b465b00d8660029
+  languageName: node
+  linkType: hard
+
 "callsites@npm:^3.0.0":
   version: 3.1.0
   resolution: "callsites@npm:3.1.0"
@@ -4888,6 +4908,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"commander@npm:~4.1.1":
+  version: 4.1.1
+  resolution: "commander@npm:4.1.1"
+  checksum: d7b9913ff92cae20cb577a4ac6fcc121bd6223319e54a40f51a14740a681ad5c574fd29a57da478a5f234a6fa6c52cbf0b7c641353e03c648b1ae85ba670b977
+  languageName: node
+  linkType: hard
+
 "component-emitter@npm:^1.2.1":
   version: 1.3.0
   resolution: "component-emitter@npm:1.3.0"
@@ -4895,6 +4922,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"component-emitter@npm:^1.3.0":
+  version: 1.3.1
+  resolution: "component-emitter@npm:1.3.1"
+  checksum: 94550aa462c7bd5a61c1bc480e28554aa306066930152d1b1844a0dd3845d4e5db7e261ddec62ae184913b3e59b55a2ad84093b9d3596a8f17c341514d6c483d
+  languageName: node
+  linkType: hard
+
 "concat-map@npm:0.0.1":
   version: 0.0.1
   resolution: "concat-map@npm:0.0.1"
@@ -4932,6 +4966,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"cookiejar@npm:^2.1.3":
+  version: 2.1.4
+  resolution: "cookiejar@npm:2.1.4"
+  checksum: c4442111963077dc0e5672359956d6556a195d31cbb35b528356ce5f184922b99ac48245ac05ed86cf993f7df157c56da10ab3efdadfed79778a0d9b1b092d5b
+  languageName: node
+  linkType: hard
+
 "copy-descriptor@npm:^0.1.0":
   version: 0.1.1
   resolution: "copy-descriptor@npm:0.1.1"
@@ -5071,6 +5112,18 @@ __metadata:
   languageName: node
   linkType: hard
 
+"debug@npm:^4.3.4":
+  version: 4.3.7
+  resolution: "debug@npm:4.3.7"
+  dependencies:
+    ms: ^2.1.3
+  peerDependenciesMeta:
+    supports-color:
+      optional: true
+  checksum: 822d74e209cd910ef0802d261b150314bbcf36c582ccdbb3e70f0894823c17e49a50d3e66d96b633524263975ca16b6a833f3e3b7e030c157169a5fabac63160
+  languageName: node
+  linkType: hard
+
 "decimal.js@npm:^10.2.1":
   version: 10.4.3
   resolution: "decimal.js@npm:10.4.3"
@@ -5119,6 +5172,17 @@ __metadata:
   languageName: node
   linkType: hard
 
+"define-data-property@npm:^1.1.4":
+  version: 1.1.4
+  resolution: "define-data-property@npm:1.1.4"
+  dependencies:
+    es-define-property: ^1.0.0
+    es-errors: ^1.3.0
+    gopd: ^1.0.1
+  checksum: 8068ee6cab694d409ac25936eb861eea704b7763f7f342adbdfe337fc27c78d7ae0eff2364b2917b58c508d723c7a074326d068eef2e45c4edcd85cf94d0313b
+  languageName: node
+  linkType: hard
+
 "define-lazy-prop@npm:^2.0.0":
   version: 2.0.0
   resolution: "define-lazy-prop@npm:2.0.0"
@@ -5205,6 +5269,16 @@ __metadata:
   languageName: node
   linkType: hard
 
+"dezalgo@npm:^1.0.4":
+  version: 1.0.4
+  resolution: "dezalgo@npm:1.0.4"
+  dependencies:
+    asap: ^2.0.0
+    wrappy: 1
+  checksum: 895389c6aead740d2ab5da4d3466d20fa30f738010a4d3f4dcccc9fc645ca31c9d10b7e1804ae489b1eb02c7986f9f1f34ba132d409b043082a86d9a4e745624
+  languageName: node
+  linkType: hard
+
 "diff-sequences@npm:^26.6.2":
   version: 26.6.2
   resolution: "diff-sequences@npm:26.6.2"
@@ -5373,6 +5447,22 @@ __metadata:
   languageName: node
   linkType: hard
 
+"es-define-property@npm:^1.0.0":
+  version: 1.0.0
+  resolution: "es-define-property@npm:1.0.0"
+  dependencies:
+    get-intrinsic: ^1.2.4
+  checksum: f66ece0a887b6dca71848fa71f70461357c0e4e7249696f81bad0a1f347eed7b31262af4a29f5d726dc026426f085483b6b90301855e647aa8e21936f07293c6
+  languageName: node
+  linkType: hard
+
+"es-errors@npm:^1.3.0":
+  version: 1.3.0
+  resolution: "es-errors@npm:1.3.0"
+  checksum: ec1414527a0ccacd7f15f4a3bc66e215f04f595ba23ca75cdae0927af099b5ec865f9f4d33e9d7e86f512f252876ac77d4281a7871531a50678132429b1271b5
+  languageName: node
+  linkType: hard
+
 "esbuild-android-64@npm:0.14.39":
   version: 0.14.39
   resolution: "esbuild-android-64@npm:0.14.39"
@@ -5813,6 +5903,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"fast-safe-stringify@npm:^2.1.1":
+  version: 2.1.1
+  resolution: "fast-safe-stringify@npm:2.1.1"
+  checksum: a851cbddc451745662f8f00ddb622d6766f9bd97642dabfd9a405fb0d646d69fc0b9a1243cbf67f5f18a39f40f6fa821737651ff1bceeba06c9992ca2dc5bd3d
+  languageName: node
+  linkType: hard
+
 "fast-xml-parser@npm:3.19.0":
   version: 3.19.0
   resolution: "fast-xml-parser@npm:3.19.0"
@@ -5956,6 +6053,18 @@ __metadata:
   languageName: node
   linkType: hard
 
+"formidable@npm:^2.0.1":
+  version: 2.1.2
+  resolution: "formidable@npm:2.1.2"
+  dependencies:
+    dezalgo: ^1.0.4
+    hexoid: ^1.0.0
+    once: ^1.4.0
+    qs: ^6.11.0
+  checksum: 81c8e5d89f5eb873e992893468f0de22c01678ca3d315db62be0560f9de1c77d4faefc9b1f4575098eb2263b3c81ba1024833a9fc3206297ddbac88a4f69b7a8
+  languageName: node
+  linkType: hard
+
 "fragment-cache@npm:^0.2.1":
   version: 0.2.1
   resolution: "fragment-cache@npm:0.2.1"
@@ -6085,6 +6194,19 @@ __metadata:
   languageName: node
   linkType: hard
 
+"get-intrinsic@npm:^1.2.4":
+  version: 1.2.4
+  resolution: "get-intrinsic@npm:1.2.4"
+  dependencies:
+    es-errors: ^1.3.0
+    function-bind: ^1.1.2
+    has-proto: ^1.0.1
+    has-symbols: ^1.0.3
+    hasown: ^2.0.0
+  checksum: 414e3cdf2c203d1b9d7d33111df746a4512a1aa622770b361dadddf8ed0b5aeb26c560f49ca077e24bfafb0acb55ca908d1f709216ccba33ffc548ec8a79a951
+  languageName: node
+  linkType: hard
+
 "get-package-type@npm:^0.1.0":
   version: 0.1.0
   resolution: "get-package-type@npm:0.1.0"
@@ -6231,6 +6353,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"graphlib@npm:^2.1.8":
+  version: 2.1.8
+  resolution: "graphlib@npm:2.1.8"
+  dependencies:
+    lodash: ^4.17.15
+  checksum: 1e0db4dea1c8187d59103d5582ecf32008845ebe2103959a51d22cb6dae495e81fb9263e22c922bca3aaecb56064a45cd53424e15a4626cfb5a0c52d0aff61a8
+  languageName: node
+  linkType: hard
+
 "has-flag@npm:^3.0.0":
   version: 3.0.0
   resolution: "has-flag@npm:3.0.0"
@@ -6263,6 +6394,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"has-property-descriptors@npm:^1.0.2":
+  version: 1.0.2
+  resolution: "has-property-descriptors@npm:1.0.2"
+  dependencies:
+    es-define-property: ^1.0.0
+  checksum: fcbb246ea2838058be39887935231c6d5788babed499d0e9d0cc5737494c48aba4fe17ba1449e0d0fbbb1e36175442faa37f9c427ae357d6ccb1d895fbcd3de3
+  languageName: node
+  linkType: hard
+
 "has-proto@npm:^1.0.1":
   version: 1.0.1
   resolution: "has-proto@npm:1.0.1"
@@ -6350,6 +6490,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"hexoid@npm:^1.0.0":
+  version: 1.0.0
+  resolution: "hexoid@npm:1.0.0"
+  checksum: 27a148ca76a2358287f40445870116baaff4a0ed0acc99900bf167f0f708ffd82e044ff55e9949c71963852b580fc024146d3ac6d5d76b508b78d927fa48ae2d
+  languageName: node
+  linkType: hard
+
 "hosted-git-info@npm:^7.0.0":
   version: 7.0.1
   resolution: "hosted-git-info@npm:7.0.1"
@@ -6542,6 +6689,8 @@ __metadata:
     glob: 10.3.3
     jest: 27.2.4
     js-yaml: 4.0.0
+    json-refs: 3.0.15
+    json-schema-to-zod: 2.4.1
     lodash: 4.17.21
     typescript: 4.6.4
     yargs: 17.7.2
@@ -7678,6 +7827,33 @@ __metadata:
   languageName: node
   linkType: hard
 
+"json-refs@npm:3.0.15":
+  version: 3.0.15
+  resolution: "json-refs@npm:3.0.15"
+  dependencies:
+    commander: ~4.1.1
+    graphlib: ^2.1.8
+    js-yaml: ^3.13.1
+    lodash: ^4.17.15
+    native-promise-only: ^0.8.1
+    path-loader: ^1.0.10
+    slash: ^3.0.0
+    uri-js: ^4.2.2
+  bin:
+    json-refs: ./bin/json-refs
+  checksum: ad77ac11eb0c6992ac870691eeb97a43663224ab32d41b02af500d253c49ea902a4c8792ebb8f1ec6df9c2369c99a62038a0ebe45ef7d3610f984ca6f32e4927
+  languageName: node
+  linkType: hard
+
+"json-schema-to-zod@npm:2.4.1":
+  version: 2.4.1
+  resolution: "json-schema-to-zod@npm:2.4.1"
+  bin:
+    json-schema-to-zod: dist/cjs/cli.js
+  checksum: acfb05c2fab8f7fd87238aa7da8e219a256d910571f82b9d9a548f44d5eb223f71c25f2bac2444776ccaa35e109c4f257a0a1a48c4f63d2dbd4ce31397a8d0e4
+  languageName: node
+  linkType: hard
+
 "json5@npm:^2.1.2":
   version: 2.1.3
   resolution: "json5@npm:2.1.3"
@@ -7803,7 +7979,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"lodash@npm:4.17.21, lodash@npm:^4.17.19, lodash@npm:^4.7.0":
+"lodash@npm:4.17.21, lodash@npm:^4.17.15, lodash@npm:^4.17.19, lodash@npm:^4.7.0":
   version: 4.17.21
   resolution: "lodash@npm:4.17.21"
   checksum: eb835a2e51d381e561e508ce932ea50a8e5a68f4ebdd771ea240d3048244a8d13658acbd502cd4829768c56f2e16bdd4340b9ea141297d472517b83868e677f7
@@ -7947,6 +8123,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"methods@npm:^1.1.2":
+  version: 1.1.2
+  resolution: "methods@npm:1.1.2"
+  checksum: 0917ff4041fa8e2f2fda5425a955fe16ca411591fbd123c0d722fcf02b73971ed6f764d85f0a6f547ce49ee0221ce2c19a5fa692157931cecb422984f1dcd13a
+  languageName: node
+  linkType: hard
+
 "micromatch@npm:^3.1.4":
   version: 3.1.10
   resolution: "micromatch@npm:3.1.10"
@@ -8004,6 +8187,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"mime@npm:2.6.0":
+  version: 2.6.0
+  resolution: "mime@npm:2.6.0"
+  bin:
+    mime: cli.js
+  checksum: 1497ba7b9f6960694268a557eae24b743fd2923da46ec392b042469f4b901721ba0adcf8b0d3c2677839d0e243b209d76e5edcbd09cfdeffa2dfb6bb4df4b862
+  languageName: node
+  linkType: hard
+
 "mimic-fn@npm:^2.1.0":
   version: 2.1.0
   resolution: "mimic-fn@npm:2.1.0"
@@ -8187,7 +8379,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ms@npm:^2.0.0":
+"ms@npm:^2.0.0, ms@npm:^2.1.3":
   version: 2.1.3
   resolution: "ms@npm:2.1.3"
   checksum: aa92de608021b242401676e35cfa5aa42dd70cbdc082b916da7fb925c542173e36bce97ea3e804923fe92c0ad991434e4a38327e15a1b5b5f945d66df615ae6d
@@ -8213,6 +8405,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"native-promise-only@npm:^0.8.1":
+  version: 0.8.1
+  resolution: "native-promise-only@npm:0.8.1"
+  checksum: bb4d8416c47d1b2cef0d4eb2c7f3442a9ed04d3734287f4037dfb7ff25948612976928e5baed105081927d5337d3f657e3a42ad2e8cca38a6428a81b32cd6dc4
+  languageName: node
+  linkType: hard
+
 "natural-compare@npm:^1.4.0":
   version: 1.4.0
   resolution: "natural-compare@npm:1.4.0"
@@ -8481,6 +8680,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"object-inspect@npm:^1.13.1":
+  version: 1.13.2
+  resolution: "object-inspect@npm:1.13.2"
+  checksum: 9f850b3c045db60e0e97746e809ee4090d6ce62195af17dd1e9438ac761394a7d8ec4f7906559aea5424eaf61e35d3e53feded2ccd5f62fcc7d9670d3c8eb353
+  languageName: node
+  linkType: hard
+
 "object-keys@npm:^1.1.1":
   version: 1.1.1
   resolution: "object-keys@npm:1.1.1"
@@ -8667,6 +8873,16 @@ __metadata:
   languageName: node
   linkType: hard
 
+"path-loader@npm:^1.0.10":
+  version: 1.0.12
+  resolution: "path-loader@npm:1.0.12"
+  dependencies:
+    native-promise-only: ^0.8.1
+    superagent: ^7.1.6
+  checksum: 50ff3bb331fc997ca817396b86b79f2adae857e6cb226bd5ddaa97b4b1a3b903502ad3e0a59cd48847d0ed15b662a8bd5ceb21b2176380727d37a64c7b8dd3c1
+  languageName: node
+  linkType: hard
+
 "path-parse@npm:^1.0.6, path-parse@npm:^1.0.7":
   version: 1.0.7
   resolution: "path-parse@npm:1.0.7"
@@ -8850,13 +9066,22 @@ __metadata:
   languageName: node
   linkType: hard
 
-"punycode@npm:^2.1.1":
+"punycode@npm:^2.1.0, punycode@npm:^2.1.1":
   version: 2.3.1
   resolution: "punycode@npm:2.3.1"
   checksum: bb0a0ceedca4c3c57a9b981b90601579058903c62be23c5e8e843d2c2d4148a3ecf029d5133486fb0e1822b098ba8bba09e89d6b21742d02fa26bda6441a6fb2
   languageName: node
   linkType: hard
 
+"qs@npm:^6.10.3, qs@npm:^6.11.0":
+  version: 6.13.0
+  resolution: "qs@npm:6.13.0"
+  dependencies:
+    side-channel: ^1.0.6
+  checksum: e9404dc0fc2849245107108ce9ec2766cde3be1b271de0bf1021d049dc5b98d1a2901e67b431ac5509f865420a7ed80b7acb3980099fe1c118a1c5d2e1432ad8
+  languageName: node
+  linkType: hard
+
 "querystring@npm:0.2.0":
   version: 0.2.0
   resolution: "querystring@npm:0.2.0"
@@ -9298,6 +9523,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"semver@npm:^7.3.7":
+  version: 7.6.3
+  resolution: "semver@npm:7.6.3"
+  bin:
+    semver: bin/semver.js
+  checksum: 4110ec5d015c9438f322257b1c51fe30276e5f766a3f64c09edd1d7ea7118ecbc3f379f3b69032bacf13116dc7abc4ad8ce0d7e2bd642e26b0d271b56b61a7d8
+  languageName: node
+  linkType: hard
+
 "set-blocking@npm:^2.0.0":
   version: 2.0.0
   resolution: "set-blocking@npm:2.0.0"
@@ -9318,6 +9552,20 @@ __metadata:
   languageName: node
   linkType: hard
 
+"set-function-length@npm:^1.2.1":
+  version: 1.2.2
+  resolution: "set-function-length@npm:1.2.2"
+  dependencies:
+    define-data-property: ^1.1.4
+    es-errors: ^1.3.0
+    function-bind: ^1.1.2
+    get-intrinsic: ^1.2.4
+    gopd: ^1.0.1
+    has-property-descriptors: ^1.0.2
+  checksum: a8248bdacdf84cb0fab4637774d9fb3c7a8e6089866d04c817583ff48e14149c87044ce683d7f50759a8c50fb87c7a7e173535b06169c87ef76f5fb276dfff72
+  languageName: node
+  linkType: hard
+
 "set-value@npm:^2.0.0, set-value@npm:^2.0.1":
   version: 2.0.1
   resolution: "set-value@npm:2.0.1"
@@ -9362,6 +9610,18 @@ __metadata:
   languageName: node
   linkType: hard
 
+"side-channel@npm:^1.0.6":
+  version: 1.0.6
+  resolution: "side-channel@npm:1.0.6"
+  dependencies:
+    call-bind: ^1.0.7
+    es-errors: ^1.3.0
+    get-intrinsic: ^1.2.4
+    object-inspect: ^1.13.1
+  checksum: bfc1afc1827d712271453e91b7cd3878ac0efd767495fd4e594c4c2afaa7963b7b510e249572bfd54b0527e66e4a12b61b80c061389e129755f34c493aad9b97
+  languageName: node
+  linkType: hard
+
 "signal-exit@npm:^3.0.0, signal-exit@npm:^3.0.7":
   version: 3.0.7
   resolution: "signal-exit@npm:3.0.7"
@@ -9700,6 +9960,25 @@ __metadata:
   languageName: node
   linkType: hard
 
+"superagent@npm:^7.1.6":
+  version: 7.1.6
+  resolution: "superagent@npm:7.1.6"
+  dependencies:
+    component-emitter: ^1.3.0
+    cookiejar: ^2.1.3
+    debug: ^4.3.4
+    fast-safe-stringify: ^2.1.1
+    form-data: ^4.0.0
+    formidable: ^2.0.1
+    methods: ^1.1.2
+    mime: 2.6.0
+    qs: ^6.10.3
+    readable-stream: ^3.6.0
+    semver: ^7.3.7
+  checksum: b73316836003219f1a4886a6d77dd28551a6784c30e871009fb7bad699fae772b20370d39d2ccb5a543c9335ce12b43a76b959a3ca983f1d6365cb4b5682c08f
+  languageName: node
+  linkType: hard
+
 "supports-color@npm:^5.3.0":
   version: 5.5.0
   resolution: "supports-color@npm:5.5.0"
@@ -10116,6 +10395,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"uri-js@npm:^4.2.2":
+  version: 4.4.1
+  resolution: "uri-js@npm:4.4.1"
+  dependencies:
+    punycode: ^2.1.0
+  checksum: 7167432de6817fe8e9e0c9684f1d2de2bb688c94388f7569f7dbdb1587c9f4ca2a77962f134ec90be0cc4d004c939ff0d05acc9f34a0db39a3c797dada262633
+  languageName: node
+  linkType: hard
+
 "urix@npm:^0.1.0":
   version: 0.1.0
   resolution: "urix@npm:0.1.0"
diff --git a/libs/auth/scopes/src/index.ts b/libs/auth/scopes/src/index.ts
index acd201a8186e..ddb61ffe1938 100644
--- a/libs/auth/scopes/src/index.ts
+++ b/libs/auth/scopes/src/index.ts
@@ -24,3 +24,5 @@ export * from './lib/recycling-fund.scope'
 export * from './lib/universityGateway.scope'
 export * from './lib/mms.scope'
 export * from './lib/judicial-system.scope'
+export * from './lib/clients/admin-portal-scopes'
+export * from './lib/clients/service-portal-scopes'
diff --git a/libs/auth/scopes/src/lib/clients/admin-portal-scopes.ts b/libs/auth/scopes/src/lib/clients/admin-portal-scopes.ts
new file mode 100644
index 000000000000..252f4457ef38
--- /dev/null
+++ b/libs/auth/scopes/src/lib/clients/admin-portal-scopes.ts
@@ -0,0 +1,23 @@
+import { AdminPortalScope } from '../admin-portal.scope'
+
+export const adminPortalScopes = [
+  AdminPortalScope.delegations,
+  AdminPortalScope.airDiscountScheme,
+  AdminPortalScope.regulationAdmin,
+  AdminPortalScope.regulationAdminManage,
+  AdminPortalScope.icelandicNamesRegistry,
+  AdminPortalScope.applicationSystemAdmin,
+  AdminPortalScope.applicationSystemInstitution,
+  AdminPortalScope.documentProvider,
+  AdminPortalScope.idsAdmin,
+  AdminPortalScope.idsAdminSuperUser,
+  AdminPortalScope.petitionsAdmin,
+  AdminPortalScope.serviceDesk,
+  AdminPortalScope.explicitAirDiscountScheme,
+  AdminPortalScope.signatureCollectionManage,
+  AdminPortalScope.signatureCollectionProcess,
+  AdminPortalScope.formSystem,
+  AdminPortalScope.formSystemSuperUser,
+  AdminPortalScope.delegationSystem,
+  AdminPortalScope.delegationSystemAdmin,
+]
diff --git a/libs/auth/scopes/src/lib/clients/service-portal-scopes.ts b/libs/auth/scopes/src/lib/clients/service-portal-scopes.ts
new file mode 100644
index 000000000000..a92a6a77914e
--- /dev/null
+++ b/libs/auth/scopes/src/lib/clients/service-portal-scopes.ts
@@ -0,0 +1,48 @@
+import { ApiScope } from '../api.scope'
+import { ApplicationScope } from '../application.scope'
+import { AuthScope } from '../auth.scope'
+import { DocumentsScope } from '../documents.scope'
+import { EndorsementsScope } from '../endorsements.scope'
+import { NationalRegistryScope } from '../nationalRegistry.scope'
+import { UserProfileScope } from '../userProfile.scope'
+
+export const servicePortalScopes = [
+  'api_resource.scope',
+  ApplicationScope.read,
+  ApplicationScope.write,
+  UserProfileScope.read,
+  UserProfileScope.write,
+  AuthScope.actorDelegations,
+  AuthScope.delegations,
+  AuthScope.consents,
+  NationalRegistryScope.individuals,
+  DocumentsScope.main,
+  EndorsementsScope.main,
+  EndorsementsScope.admin,
+  ApiScope.intellectualProperties,
+  ApiScope.assets,
+  ApiScope.education,
+  ApiScope.educationLicense,
+  ApiScope.financeOverview,
+  ApiScope.financeSalary,
+  ApiScope.financeSchedule,
+  ApiScope.financeLoans,
+  ApiScope.internal,
+  ApiScope.internalProcuring,
+  ApiScope.meDetails,
+  ApiScope.licenses,
+  ApiScope.licensesVerify,
+  ApiScope.company,
+  ApiScope.vehicles,
+  ApiScope.workMachines,
+  ApiScope.healthPayments,
+  ApiScope.healthMedicines,
+  ApiScope.healthAssistiveAndNutrition,
+  ApiScope.healthTherapies,
+  ApiScope.healthHealthcare,
+  ApiScope.healthRightsStatus,
+  ApiScope.healthDentists,
+  ApiScope.healthOrganDonation,
+  ApiScope.healthVaccinations,
+  ApiScope.signatureCollection,
+]
diff --git a/libs/infra-nest-server/src/lib/bootstrap.ts b/libs/infra-nest-server/src/lib/bootstrap.ts
index 01a442e76f77..686fe5cfe07c 100644
--- a/libs/infra-nest-server/src/lib/bootstrap.ts
+++ b/libs/infra-nest-server/src/lib/bootstrap.ts
@@ -50,6 +50,10 @@ export const createApp = async ({
     app.enableVersioning()
   }
 
+  if (options.enableCors) {
+    app.enableCors(options.enableCors)
+  }
+
   // Configure "X-Requested-For" handling.
   // Internal services should trust the X-Forwarded-For header (EXPRESS_TRUST_PROXY=1)
   // Public services (eg API Gateway) should trust our own reverse proxies
@@ -66,8 +70,10 @@ export const createApp = async ({
     }),
   )
 
-  if (options.globalPrefix) {
-    app.setGlobalPrefix(options.globalPrefix)
+  const globalPrefix = options.globalPrefix
+
+  if (globalPrefix) {
+    app.setGlobalPrefix(globalPrefix)
   }
 
   if (options.collectMetrics !== false) {
diff --git a/libs/infra-nest-server/src/lib/types.ts b/libs/infra-nest-server/src/lib/types.ts
index 7e37851701ff..8426a6d00cf4 100644
--- a/libs/infra-nest-server/src/lib/types.ts
+++ b/libs/infra-nest-server/src/lib/types.ts
@@ -2,6 +2,7 @@ import { INestApplication, NestInterceptor, Type } from '@nestjs/common'
 import { OpenAPIObject } from '@nestjs/swagger'
 import { Server } from 'http'
 
+import { CorsOptions } from '@nestjs/common/interfaces/external/cors-options.interface'
 import { HealthCheckOptions } from './infra/health/types'
 
 export type RunServerOptions = {
@@ -74,6 +75,11 @@ export type RunServerOptions = {
    */
   healthCheck?: boolean | HealthCheckOptions
 
+  /**
+   * Enables CORS (Cross-Origin Resource Sharing)
+   */
+  enableCors?: CorsOptions
+
   /**
    * Hook to run before app is initialized.
    */
diff --git a/libs/island-ui/storybook/config/main.ts b/libs/island-ui/storybook/config/main.ts
index 3cd410158982..3c9e5ccccacd 100644
--- a/libs/island-ui/storybook/config/main.ts
+++ b/libs/island-ui/storybook/config/main.ts
@@ -96,6 +96,7 @@ const config: StorybookConfig = {
         ),
         '@island.is/feature-flags': rootDir('../../../feature-flags/src'),
         '@island.is/react-spa/shared': rootDir('../../../react-spa/shared/src'),
+        '@island.is/react-spa/bff': rootDir('../../../react-spa/bff/src'),
       },
     }
     return config
diff --git a/libs/portals/admin/application-system/src/module.tsx b/libs/portals/admin/application-system/src/module.tsx
index 908f7350de91..23cf6281bc34 100644
--- a/libs/portals/admin/application-system/src/module.tsx
+++ b/libs/portals/admin/application-system/src/module.tsx
@@ -19,7 +19,7 @@ const allowedScopes: string[] = [
   AdminPortalScope.applicationSystemInstitution,
 ]
 const getScreen = ({ userInfo }: PortalModuleRoutesProps): React.ReactNode => {
-  if (userInfo.scope?.includes(AdminPortalScope.applicationSystemInstitution)) {
+  if (userInfo.scopes.includes(AdminPortalScope.applicationSystemInstitution)) {
     return <InstitutionOverview />
   }
   return <Overview />
@@ -51,7 +51,7 @@ export const applicationSystemAdminModule: PortalModule = {
           name: m.statistics,
           path: ApplicationSystemPaths.Statistics,
           element: <Statistics />,
-          enabled: props.userInfo.scope?.includes(
+          enabled: props.userInfo.scopes.includes(
             AdminPortalScope.applicationSystemAdmin,
           ),
         },
diff --git a/libs/portals/admin/application-system/src/screens/Overview/InstitutionOverview.tsx b/libs/portals/admin/application-system/src/screens/Overview/InstitutionOverview.tsx
index 4baa487414de..904561742ebd 100644
--- a/libs/portals/admin/application-system/src/screens/Overview/InstitutionOverview.tsx
+++ b/libs/portals/admin/application-system/src/screens/Overview/InstitutionOverview.tsx
@@ -19,7 +19,7 @@ import { ApplicationFilters, MultiChoiceFilter } from '../../types/filters'
 import { Organization } from '@island.is/shared/types'
 import { institutionMapper } from '@island.is/application/types'
 import { AdminApplication } from '../../types/adminApplication'
-import { useUserInfo } from '@island.is/auth/react'
+import { useUserInfo } from '@island.is/react-spa/bff'
 import endOfDay from 'date-fns/endOfDay'
 
 const defaultFilters: ApplicationFilters = {
diff --git a/libs/portals/admin/ids-admin/src/hooks/useSuperAdmin.tsx b/libs/portals/admin/ids-admin/src/hooks/useSuperAdmin.tsx
index 9dd93708336e..ef18544a3726 100644
--- a/libs/portals/admin/ids-admin/src/hooks/useSuperAdmin.tsx
+++ b/libs/portals/admin/ids-admin/src/hooks/useSuperAdmin.tsx
@@ -1,8 +1,8 @@
-import { useAuth } from '@island.is/auth/react'
 import { AdminPortalScope } from '@island.is/auth/scopes'
+import { useUserInfo } from '@island.is/react-spa/bff'
 
 export const useSuperAdmin = () => {
-  const { userInfo } = useAuth()
+  const userInfo = useUserInfo()
 
   const isSuperAdmin = userInfo?.scopes.includes(
     AdminPortalScope.idsAdminSuperUser,
diff --git a/libs/portals/admin/regulations-admin/src/components/DownloadDraftButton.tsx b/libs/portals/admin/regulations-admin/src/components/DownloadDraftButton.tsx
index 50ddeee88fe1..5e4054aad9ed 100644
--- a/libs/portals/admin/regulations-admin/src/components/DownloadDraftButton.tsx
+++ b/libs/portals/admin/regulations-admin/src/components/DownloadDraftButton.tsx
@@ -1,13 +1,13 @@
-import { useEffect } from 'react'
 import { gql, useLazyQuery } from '@apollo/client'
 import { Query } from '@island.is/api/schema'
+import { useEffect, useState } from 'react'
 
 import { Button, toast } from '@island.is/island-ui/core'
 
 import { useLocale } from '@island.is/localization'
-import { editorMsgs, reviewMessages } from '../lib/messages'
+import { useBffUrlGenerator } from '@island.is/react-spa/bff'
 import type { RegulationDraftId } from '@island.is/regulations/admin'
-import { useAuth } from '@island.is/auth/react'
+import { editorMsgs, reviewMessages } from '../lib/messages'
 
 type Props = {
   draftId: RegulationDraftId
@@ -23,40 +23,21 @@ const DownloadRegulationDraftQuery = gql`
   }
 `
 
-function formSubmit(url: string, token: string) {
-  // Create form elements
-  const form = document.createElement('form')
-  const tokenInput = document.createElement('input')
-
-  form.appendChild(tokenInput)
-
-  // Form values
-  form.method = 'post'
-  form.action = url
-  form.target = '_blank'
-
-  // National Id values
-  tokenInput.type = 'hidden'
-  tokenInput.name = '__accessToken'
-  tokenInput.value = token
-
-  document.body.appendChild(form)
-  form.submit()
-  document.body.removeChild(form)
-}
-
-export function DownloadDraftButton({ draftId, reviewButton }: Props) {
-  const userInfo = useAuth().userInfo
+export const DownloadDraftButton = ({ draftId, reviewButton }: Props) => {
+  const bffUrlGenerator = useBffUrlGenerator()
+  const [isFetchingFile, setIsFetchingFile] = useState(false)
   const t = useLocale().formatMessage
-  const [downloadRegulation, { called, loading, error, data }] =
-    useLazyQuery<Query>(DownloadRegulationDraftQuery, {
+  const [downloadRegulation, { loading, error, data }] = useLazyQuery<Query>(
+    DownloadRegulationDraftQuery,
+    {
       variables: {
         input: {
           draftId,
         },
       },
       fetchPolicy: 'no-cache',
-    })
+    },
+  )
 
   useEffect(() => {
     if (error) {
@@ -65,27 +46,30 @@ export function DownloadDraftButton({ draftId, reviewButton }: Props) {
   }, [t, error])
 
   useEffect(() => {
-    if (called && data) {
-      const response = data.getDraftRegulationPdfDownload
-      const url = response?.url
-
-      if (url && userInfo) {
-        formSubmit(url, userInfo.access_token)
-      } else {
-        toast.error(t(editorMsgs.signedDocumentDownloadFreshError))
-      }
+    const url = data?.getDraftRegulationPdfDownload?.url
+
+    if (url && !isFetchingFile) {
+      window.open(
+        bffUrlGenerator('/api', {
+          url,
+        }),
+        '_blank',
+      )
+    } else if (data && !url) {
+      toast.error(t(editorMsgs.signedDocumentDownloadFreshError))
     }
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [called, data, userInfo?.access_token])
+  }, [data])
 
   const onClick = async () => {
     downloadRegulation()
   }
 
+  const isLoading = loading || isFetchingFile
+
   if (reviewButton) {
     return (
       <Button
-        loading={loading}
+        loading={isLoading}
         as="button"
         onClick={onClick}
         icon="download"
@@ -99,7 +83,7 @@ export function DownloadDraftButton({ draftId, reviewButton }: Props) {
   }
 
   return (
-    <Button loading={loading} onClick={onClick} icon="download">
+    <Button loading={isLoading} onClick={onClick} icon="download">
       {t(editorMsgs.signedDocumentDownloadFresh)}
     </Button>
   )
diff --git a/libs/portals/admin/regulations-admin/src/state/reducer.ts b/libs/portals/admin/regulations-admin/src/state/reducer.ts
index 3771f45b70f7..1b03eb072486 100644
--- a/libs/portals/admin/regulations-admin/src/state/reducer.ts
+++ b/libs/portals/admin/regulations-admin/src/state/reducer.ts
@@ -1,14 +1,14 @@
+import { AdminPortalScope } from '@island.is/auth/scopes'
+import { useUserInfo } from '@island.is/react-spa/bff'
+import { LawChapter, MinistryList } from '@island.is/regulations'
+import { DraftImpactId, RegulationDraft } from '@island.is/regulations/admin'
+import { produce, setAutoFreeze } from 'immer'
 import { Reducer, useReducer } from 'react'
 import { RegulationDraftTypes, Step } from '../types'
-import { LawChapter, MinistryList } from '@island.is/regulations'
+import { actionHandlers } from './actionHandlers'
+import { makeDraftForm, stepsAmending, stepsBase } from './makeFields'
 import { Action, DraftingState, RegDraftFormSimpleProps } from './types'
-import { produce, setAutoFreeze } from 'immer'
-import { DraftImpactId, RegulationDraft } from '@island.is/regulations/admin'
-import { useAuth } from '@island.is/auth/react'
-import { AdminPortalScope } from '@island.is/auth/scopes'
 import { derivedUpdates, validateState } from './validations'
-import { makeDraftForm, stepsAmending, stepsBase } from './makeFields'
-import { actionHandlers } from './actionHandlers'
 
 const draftingStateReducer: Reducer<DraftingState, Action> = (
   state,
@@ -40,9 +40,8 @@ export const useEditDraftReducer = (inputs: StateInputs) => {
   const { regulationDraft, ministries, lawChapters, stepName } = inputs
 
   const isEditor =
-    useAuth().userInfo?.scopes?.includes(
-      AdminPortalScope.regulationAdminManage,
-    ) || false
+    useUserInfo()?.scopes?.includes(AdminPortalScope.regulationAdminManage) ||
+    false
 
   const makeInitialState = () => {
     const draft = makeDraftForm(regulationDraft)
diff --git a/libs/portals/admin/service-desk/src/screens/Users/Users.tsx b/libs/portals/admin/service-desk/src/screens/Users/Users.tsx
index 6e66784fba2a..d78b0fa1b1cc 100644
--- a/libs/portals/admin/service-desk/src/screens/Users/Users.tsx
+++ b/libs/portals/admin/service-desk/src/screens/Users/Users.tsx
@@ -10,7 +10,7 @@ import {
 import { formatNationalId, IntroHeader } from '@island.is/portals/core'
 import { maskString } from '@island.is/shared/utils'
 import { useLocale } from '@island.is/localization'
-import { useAuth } from '@island.is/auth/react'
+import { useUserInfo } from '@island.is/react-spa/bff'
 import { replaceParams, useSubmitting } from '@island.is/react-spa/shared'
 
 import * as styles from '../Companies/Companies.css'
@@ -26,7 +26,7 @@ const Users = () => {
   const actionData = useActionData() as GetUserProfilesResult
   const { formatMessage } = useLocale()
   const navigate = useNavigate()
-  const { userInfo } = useAuth()
+  const userInfo = useUserInfo()
   const { isSubmitting, isLoading } = useSubmitting()
   const users = actionData?.data?.data
   const [error, setError] = useState({ hasError: false, message: '' })
diff --git a/libs/portals/core/src/components/PortalProvider.tsx b/libs/portals/core/src/components/PortalProvider.tsx
index 5aff6abb53a8..6c2159127d72 100644
--- a/libs/portals/core/src/components/PortalProvider.tsx
+++ b/libs/portals/core/src/components/PortalProvider.tsx
@@ -1,13 +1,13 @@
-import { useLocale } from '@island.is/localization'
-import { createContext, useContext, useMemo } from 'react'
-import { useLocation, matchPath, Outlet } from 'react-router-dom'
-import { PortalModule, PortalRoute, PortalType } from '../types/portalCore'
-import { useAuth } from '@island.is/auth/react'
 import {
   ApolloClient,
-  useApolloClient,
   NormalizedCacheObject,
+  useApolloClient,
 } from '@apollo/client'
+import { useLocale } from '@island.is/localization'
+import { useUserInfo } from '@island.is/react-spa/bff'
+import { createContext, useContext, useMemo } from 'react'
+import { Outlet, matchPath, useLocation } from 'react-router-dom'
+import { PortalModule, PortalRoute, PortalType } from '../types/portalCore'
 
 export type PortalMeta = {
   portalType: PortalType
@@ -44,7 +44,7 @@ export const PortalProvider = ({
   routes,
 }: PortalProviderProps) => {
   const { pathname } = useLocation()
-  const { userInfo } = useAuth()
+  const userInfo = useUserInfo()
   const { formatMessage } = useLocale()
   const client = useApolloClient() as ApolloClient<NormalizedCacheObject>
 
diff --git a/libs/portals/core/src/components/PortalRouter.tsx b/libs/portals/core/src/components/PortalRouter.tsx
index 38038aa1a0c1..d85ec65d0837 100644
--- a/libs/portals/core/src/components/PortalRouter.tsx
+++ b/libs/portals/core/src/components/PortalRouter.tsx
@@ -1,24 +1,24 @@
-import React, { useEffect, useState, useRef } from 'react'
+import React, { useEffect, useRef, useState } from 'react'
 import {
-  createBrowserRouter,
   RouteObject,
   RouterProvider,
+  createBrowserRouter,
 } from 'react-router-dom'
 
 import {
-  useApolloClient,
   ApolloClient,
   NormalizedCacheObject,
+  useApolloClient,
 } from '@apollo/client'
 import { useLocale } from '@island.is/localization'
-import { useFeatureFlagClient } from '@island.is/react/feature-flags'
-import { useAuth } from '@island.is/auth/react'
+import { useUserInfo } from '@island.is/react-spa/bff'
 import { LoadingScreen } from '@island.is/react/components'
-import { createModuleRoutes } from '../utils/router/createModuleRoutes'
+import { useFeatureFlagClient } from '@island.is/react/feature-flags'
+import { m } from '../lib/messages'
 import { PortalModule, PortalRoute } from '../types/portalCore'
-import { PortalMeta, PortalProvider } from './PortalProvider'
+import { createModuleRoutes } from '../utils/router/createModuleRoutes'
 import { prepareRouterData } from '../utils/router/prepareRouterData'
-import { m } from '../lib/messages'
+import { PortalMeta, PortalProvider } from './PortalProvider'
 
 type PortalRouterProps = {
   modules: PortalModule[]
@@ -37,7 +37,7 @@ export const PortalRouter = ({
   const { formatMessage } = useLocale()
   const router = useRef<ReturnType<typeof createBrowserRouter>>()
   const [error, setError] = useState<Error | null>(null)
-  const { userInfo } = useAuth()
+  const userInfo = useUserInfo()
   const featureFlagClient = useFeatureFlagClient()
   const [routerData, setRouterData] = useState<{
     modules: PortalModule[]
diff --git a/libs/portals/core/src/hooks/useModuleProps.ts b/libs/portals/core/src/hooks/useModuleProps.ts
index a6e18220c078..895bc5744f57 100644
--- a/libs/portals/core/src/hooks/useModuleProps.ts
+++ b/libs/portals/core/src/hooks/useModuleProps.ts
@@ -3,10 +3,10 @@ import {
   ApolloClient,
   NormalizedCacheObject,
 } from '@apollo/client'
-import { useAuth } from '@island.is/auth/react'
+import { useUserInfo } from '@island.is/react-spa/bff'
 
 export const useModuleProps = () => {
-  const { userInfo } = useAuth()
+  const userInfo = useUserInfo()
   const client = useApolloClient() as ApolloClient<NormalizedCacheObject>
 
   if (userInfo === null) {
diff --git a/libs/portals/core/src/hooks/useNavigation.ts b/libs/portals/core/src/hooks/useNavigation.ts
index fe7156246abe..344ec5840b6c 100644
--- a/libs/portals/core/src/hooks/useNavigation.ts
+++ b/libs/portals/core/src/hooks/useNavigation.ts
@@ -1,6 +1,6 @@
+import { useUserInfo } from '@island.is/react-spa/bff'
 import { useMemo } from 'react'
 import { useLocation } from 'react-router-dom'
-import { useAuth } from '@island.is/auth/react'
 import { useRoutes } from '../components/PortalProvider'
 import { PortalNavigationItem } from '../types/portalCore'
 import { filterNavigationTree } from '../utils/filterNavigationTree/filterNavigationTree'
@@ -9,7 +9,7 @@ export const useNavigation = (
   navigation: PortalNavigationItem,
   dynamicRouteArray?: string[],
 ) => {
-  const { userInfo } = useAuth()
+  const userInfo = useUserInfo()
   const routes = useRoutes()
   const { pathname } = useLocation()
 
diff --git a/libs/portals/core/src/index.ts b/libs/portals/core/src/index.ts
index 398eba645449..228aa2fa7539 100644
--- a/libs/portals/core/src/index.ts
+++ b/libs/portals/core/src/index.ts
@@ -1,3 +1,6 @@
+// mocks
+export * from './mocks'
+
 // libs
 export * from './lib/paths'
 export * from './lib/messages'
diff --git a/libs/portals/core/src/mocks/index.ts b/libs/portals/core/src/mocks/index.ts
new file mode 100644
index 000000000000..2d1618cb1f70
--- /dev/null
+++ b/libs/portals/core/src/mocks/index.ts
@@ -0,0 +1 @@
+export const isMockMode = process.env.API_MOCKS === 'true'
diff --git a/libs/portals/core/src/screens/AccessDenied.tsx b/libs/portals/core/src/screens/AccessDenied.tsx
index ac7b5b5854c4..8ae9d5caa7dd 100644
--- a/libs/portals/core/src/screens/AccessDenied.tsx
+++ b/libs/portals/core/src/screens/AccessDenied.tsx
@@ -1,5 +1,5 @@
 import { useLocale } from '@island.is/localization'
-import { useAuth } from '@island.is/auth/react'
+import { useUserInfo } from '@island.is/react-spa/bff'
 import { checkDelegation } from '@island.is/shared/utils'
 
 import { m } from '../lib/messages'
@@ -7,7 +7,7 @@ import { Problem } from '@island.is/react-spa/shared'
 
 export const AccessDenied = () => {
   const { formatMessage } = useLocale()
-  const { userInfo: user } = useAuth()
+  const user = useUserInfo()
   const isDelegation = user && checkDelegation(user)
 
   return (
diff --git a/libs/portals/core/src/screens/ModuleRoute.tsx b/libs/portals/core/src/screens/ModuleRoute.tsx
index ef37780576d7..156082b039f1 100644
--- a/libs/portals/core/src/screens/ModuleRoute.tsx
+++ b/libs/portals/core/src/screens/ModuleRoute.tsx
@@ -5,7 +5,7 @@ import { PortalRoute } from '../types/portalCore'
 import { usePortalMeta } from '../components/PortalProvider'
 import { plausiblePageviewDetail } from '../utils/plausible'
 import { Box } from '@island.is/island-ui/core'
-import { useAuth } from '@island.is/auth/react'
+import { useUserInfo } from '@island.is/react-spa/bff'
 
 type ModuleRouteProps = {
   route: PortalRoute
@@ -14,7 +14,7 @@ type ModuleRouteProps = {
 export const ModuleRoute = React.memo(({ route }: ModuleRouteProps) => {
   const location = useLocation()
   const { basePath, portalTitle } = usePortalMeta()
-  const { userInfo } = useAuth()
+  const userInfo = useUserInfo()
   const { formatMessage } = useLocale()
 
   useEffect(() => {
diff --git a/libs/portals/core/src/types/portalCore.ts b/libs/portals/core/src/types/portalCore.ts
index 5dc5375c089d..fb426c2a1890 100644
--- a/libs/portals/core/src/types/portalCore.ts
+++ b/libs/portals/core/src/types/portalCore.ts
@@ -6,7 +6,7 @@ import { RouteObject } from 'react-router-dom'
 
 import type { Features } from '@island.is/react/feature-flags'
 import { IconProps } from '@island.is/island-ui/core'
-import { User } from '@island.is/shared/types'
+import { BffUser } from '@island.is/shared/types'
 import { OrganizationSlugType } from '@island.is/shared/constants'
 
 /**
@@ -79,7 +79,7 @@ export interface PortalNavigationItem {
  * The props provided to a  portal module
  */
 export interface PortalModuleProps {
-  userInfo: User
+  userInfo: BffUser
 }
 
 export interface PortalModuleRoutesProps extends PortalModuleProps {
@@ -166,7 +166,7 @@ export interface PortalModule {
   /**
    * Indicates if module is enabled or not
    */
-  enabled?: (props: { userInfo: User; isCompany: boolean }) => boolean
+  enabled?: (props: { userInfo: BffUser; isCompany: boolean }) => boolean
 
   /**
    * The layout type of the module
diff --git a/libs/portals/core/src/utils/modules.ts b/libs/portals/core/src/utils/modules.ts
index 33c3b6449df2..09b85d297fb3 100644
--- a/libs/portals/core/src/utils/modules.ts
+++ b/libs/portals/core/src/utils/modules.ts
@@ -1,6 +1,6 @@
 import { FormatMessage } from '@island.is/localization'
 import flatten from 'lodash/flatten'
-import type { User } from '@island.is/shared/types'
+import type { BffUser } from '@island.is/shared/types'
 import { FeatureFlagClient } from '@island.is/react/feature-flags'
 import type { PortalModule, PortalRoute } from '../types/portalCore'
 import { ApolloClient, NormalizedCacheObject } from '@apollo/client'
@@ -8,7 +8,7 @@ import { ApolloClient, NormalizedCacheObject } from '@apollo/client'
 interface FilterEnabledModulesArgs {
   modules: PortalModule[]
   featureFlagClient: FeatureFlagClient
-  userInfo: User
+  userInfo: BffUser
 }
 
 export const filterEnabledModules = async ({
@@ -41,7 +41,7 @@ export const filterEnabledModules = async ({
 }
 
 interface ArrangeRoutesArgs {
-  userInfo: User
+  userInfo: BffUser
   modules: PortalModule[]
   featureFlagClient: FeatureFlagClient
   client: ApolloClient<NormalizedCacheObject>
diff --git a/libs/portals/core/src/utils/router/prepareRouterData.ts b/libs/portals/core/src/utils/router/prepareRouterData.ts
index 7534f0de5233..d0959b3d9cb8 100644
--- a/libs/portals/core/src/utils/router/prepareRouterData.ts
+++ b/libs/portals/core/src/utils/router/prepareRouterData.ts
@@ -2,11 +2,11 @@ import { ApolloClient, NormalizedCacheObject } from '@apollo/client'
 import { FormatMessage } from '@island.is/localization'
 import { arrangeRoutes, filterEnabledModules } from '../modules'
 import { FeatureFlagClient } from '@island.is/feature-flags'
-import { User } from '@island.is/shared/types'
+import { BffUser } from '@island.is/shared/types'
 import { PortalModule, PortalRoute } from '../../types/portalCore'
 
 export type PrepareRouterDataProps = {
-  userInfo: User
+  userInfo: BffUser
   featureFlagClient: FeatureFlagClient
   modules: PortalModule[]
   client: ApolloClient<NormalizedCacheObject>
@@ -16,7 +16,7 @@ export type PrepareRouterDataProps = {
 export type PrepareRouterDataReturnType = {
   modules: PortalModule[]
   routes: PortalRoute[]
-  userInfo: User
+  userInfo: BffUser
   formatMessage: FormatMessage
 }
 
diff --git a/libs/portals/shared-modules/delegations/src/components/access/AccessConfirmModal.tsx b/libs/portals/shared-modules/delegations/src/components/access/AccessConfirmModal.tsx
index 740c1f015906..dbb8f00a3c9e 100644
--- a/libs/portals/shared-modules/delegations/src/components/access/AccessConfirmModal.tsx
+++ b/libs/portals/shared-modules/delegations/src/components/access/AccessConfirmModal.tsx
@@ -1,6 +1,6 @@
 import { isDefined } from '@island.is/shared/utils'
 import { AuthDelegationScope } from '@island.is/api/schema'
-import { useAuth } from '@island.is/auth/react'
+import { useUserInfo } from '@island.is/react-spa/bff'
 import { Box, useBreakpoint } from '@island.is/island-ui/core'
 import { useLocale } from '@island.is/localization'
 import { formatNationalId, m as coreMessages } from '@island.is/portals/core'
@@ -37,7 +37,7 @@ export const AccessConfirmModal = ({
   ...rest
 }: AccessConfirmModalProps) => {
   const { formatMessage } = useLocale()
-  const { userInfo } = useAuth()
+  const userInfo = useUserInfo()
   const { md } = useBreakpoint()
   const [error, setError] = useState(formError ?? false)
 
diff --git a/libs/portals/shared-modules/delegations/src/components/access/AccessDeleteModal/AccessDeleteModal.tsx b/libs/portals/shared-modules/delegations/src/components/access/AccessDeleteModal/AccessDeleteModal.tsx
index 81903fff5335..1ae08d68f59a 100644
--- a/libs/portals/shared-modules/delegations/src/components/access/AccessDeleteModal/AccessDeleteModal.tsx
+++ b/libs/portals/shared-modules/delegations/src/components/access/AccessDeleteModal/AccessDeleteModal.tsx
@@ -1,24 +1,24 @@
 import { useEffect, useState } from 'react'
 
-import { useAuth } from '@island.is/auth/react'
 import { Box, toast, useBreakpoint } from '@island.is/island-ui/core'
 import { useLocale } from '@island.is/localization'
 import { formatNationalId } from '@island.is/portals/core'
+import { useUserInfo } from '@island.is/react-spa/bff'
 import { Problem } from '@island.is/react-spa/shared'
 import { Modal, ModalProps } from '@island.is/react/components'
 import { AuthDelegationType } from '@island.is/shared/types'
 
-import { DelegationsFormFooter } from '../../delegations/DelegationsFormFooter'
-import { IdentityCard } from '../../IdentityCard/IdentityCard'
-import { AccessListContainer } from '../AccessList/AccessListContainer/AccessListContainer'
-import { useAuthScopeTreeLazyQuery } from '../AccessList/AccessListContainer/AccessListContainer.generated'
-import { useDeleteAuthDelegationMutation } from './AccessDeleteModal.generated'
+import { useDynamicShadow } from '../../../hooks/useDynamicShadow'
+import { m } from '../../../lib/messages'
 import {
   AuthCustomDelegation,
   AuthCustomDelegationOutgoing,
 } from '../../../types/customDelegation'
-import { m } from '../../../lib/messages'
-import { useDynamicShadow } from '../../../hooks/useDynamicShadow'
+import { IdentityCard } from '../../IdentityCard/IdentityCard'
+import { DelegationsFormFooter } from '../../delegations/DelegationsFormFooter'
+import { AccessListContainer } from '../AccessList/AccessListContainer/AccessListContainer'
+import { useAuthScopeTreeLazyQuery } from '../AccessList/AccessListContainer/AccessListContainer.generated'
+import { useDeleteAuthDelegationMutation } from './AccessDeleteModal.generated'
 
 type AccessDeleteModalProps = Pick<ModalProps, 'onClose' | 'isVisible'> & {
   delegation?: AuthCustomDelegation
@@ -32,7 +32,7 @@ export const AccessDeleteModal = ({
   ...rest
 }: AccessDeleteModalProps) => {
   const { formatMessage, lang } = useLocale()
-  const { userInfo } = useAuth()
+  const userInfo = useUserInfo()
   const { md } = useBreakpoint()
   const [error, setError] = useState(false)
   const [deleteAuthDelegation, { loading }] = useDeleteAuthDelegationMutation()
diff --git a/libs/portals/shared-modules/delegations/src/screens/AccessControl.tsx b/libs/portals/shared-modules/delegations/src/screens/AccessControl.tsx
index bda0137d5844..ea32968da1da 100644
--- a/libs/portals/shared-modules/delegations/src/screens/AccessControl.tsx
+++ b/libs/portals/shared-modules/delegations/src/screens/AccessControl.tsx
@@ -1,11 +1,10 @@
-import React from 'react'
-import { useNavigate } from 'react-router-dom'
-import { useLocation } from 'react-use'
 import { Box, Button, GridColumn, Tabs } from '@island.is/island-ui/core'
-import { IntroHeader, usePortalMeta } from '@island.is/portals/core'
 import { useLocale, useNamespaces } from '@island.is/localization'
-import { useAuth } from '@island.is/auth/react'
+import { IntroHeader, usePortalMeta } from '@island.is/portals/core'
+import { useUserInfo } from '@island.is/react-spa/bff'
 import { isDefined } from '@island.is/shared/utils'
+import { useNavigate } from 'react-router-dom'
+import { useLocation } from 'react-use'
 import { DelegationsIncoming } from '../components/delegations/incoming/DelegationsIncoming'
 import { DelegationsOutgoing } from '../components/delegations/outgoing/DelegationsOutgoing'
 import { m } from '../lib/messages'
@@ -18,7 +17,7 @@ const AccessControl = () => {
   useNamespaces(['sp.access-control-delegations'])
 
   const { formatMessage } = useLocale()
-  const { userInfo } = useAuth()
+  const userInfo = useUserInfo()
   const navigate = useNavigate()
   const location = useLocation()
   const { basePath } = usePortalMeta()
diff --git a/libs/portals/shared-modules/delegations/src/screens/GrantAccess/GrantAccess.tsx b/libs/portals/shared-modules/delegations/src/screens/GrantAccess/GrantAccess.tsx
index b9244ccbbabd..60b74e5bd3d0 100644
--- a/libs/portals/shared-modules/delegations/src/screens/GrantAccess/GrantAccess.tsx
+++ b/libs/portals/shared-modules/delegations/src/screens/GrantAccess/GrantAccess.tsx
@@ -1,36 +1,38 @@
 import cn from 'classnames'
 import * as kennitala from 'kennitala'
-import get from 'lodash/get'
 import React, { useEffect, useState } from 'react'
-import { defineMessage } from 'react-intl'
 import { Control, FormProvider, useForm } from 'react-hook-form'
+import { defineMessage } from 'react-intl'
 import { useNavigate } from 'react-router-dom'
 
-import { useUserInfo } from '@island.is/auth/react'
 import {
   Box,
-  Input,
   Icon,
-  toast,
-  Text,
+  Input,
   SkeletonLoader,
+  Text,
+  toast,
   useBreakpoint,
 } from '@island.is/island-ui/core'
 import { useLocale, useNamespaces } from '@island.is/localization'
-import { IntroHeader } from '@island.is/portals/core'
-import { formatNationalId, m as coreMessages } from '@island.is/portals/core'
+import {
+  IntroHeader,
+  m as coreMessages,
+  formatNationalId,
+} from '@island.is/portals/core'
+import { useUserInfo } from '@island.is/react-spa/bff'
 import { Problem } from '@island.is/react-spa/shared'
 import {
   InputController,
   SelectController,
 } from '@island.is/shared/form-fields'
 
-import { DelegationsFormFooter } from '../../components/delegations/DelegationsFormFooter'
 import { IdentityCard } from '../../components/IdentityCard/IdentityCard'
-import { DomainOption, useDomains } from '../../hooks/useDomains/useDomains'
+import { DelegationsFormFooter } from '../../components/delegations/DelegationsFormFooter'
 import { ALL_DOMAINS } from '../../constants/domain'
-import { DelegationPaths } from '../../lib/paths'
+import { DomainOption, useDomains } from '../../hooks/useDomains/useDomains'
 import { m } from '../../lib/messages'
+import { DelegationPaths } from '../../lib/paths'
 import {
   useCreateAuthDelegationMutation,
   useIdentityLazyQuery,
diff --git a/libs/react-spa/bff/.babelrc b/libs/react-spa/bff/.babelrc
new file mode 100644
index 000000000000..1ea870ead410
--- /dev/null
+++ b/libs/react-spa/bff/.babelrc
@@ -0,0 +1,12 @@
+{
+  "presets": [
+    [
+      "@nx/react/babel",
+      {
+        "runtime": "automatic",
+        "useBuiltIns": "usage"
+      }
+    ]
+  ],
+  "plugins": []
+}
diff --git a/libs/react-spa/bff/.eslintrc.json b/libs/react-spa/bff/.eslintrc.json
new file mode 100644
index 000000000000..75b85077debb
--- /dev/null
+++ b/libs/react-spa/bff/.eslintrc.json
@@ -0,0 +1,18 @@
+{
+  "extends": ["plugin:@nx/react", "../../../.eslintrc.json"],
+  "ignorePatterns": ["!**/*"],
+  "overrides": [
+    {
+      "files": ["*.ts", "*.tsx", "*.js", "*.jsx"],
+      "rules": {}
+    },
+    {
+      "files": ["*.ts", "*.tsx"],
+      "rules": {}
+    },
+    {
+      "files": ["*.js", "*.jsx"],
+      "rules": {}
+    }
+  ]
+}
diff --git a/libs/react-spa/bff/README.md b/libs/react-spa/bff/README.md
new file mode 100644
index 000000000000..53a6d1e6ec85
--- /dev/null
+++ b/libs/react-spa/bff/README.md
@@ -0,0 +1,7 @@
+# React SPA BFF
+
+This library is intended to be used by a React SPA application. It handles authentication with a BFF(Backend For Frontend) server.
+
+## Running unit tests
+
+Run `nx test react-spa-bff` to execute the unit tests via [Jest](https://jestjs.io).
diff --git a/libs/react-spa/bff/jest.config.ts b/libs/react-spa/bff/jest.config.ts
new file mode 100644
index 000000000000..46183d6c70f0
--- /dev/null
+++ b/libs/react-spa/bff/jest.config.ts
@@ -0,0 +1,11 @@
+/* eslint-disable */
+export default {
+  displayName: 'bff',
+  preset: '../../../jest.preset.js',
+  transform: {
+    '^(?!.*\\.(js|jsx|ts|tsx|css|json)$)': '@nx/react/plugins/jest',
+    '^.+\\.[tj]sx?$': ['babel-jest', { presets: ['@nx/react/babel'] }],
+  },
+  moduleFileExtensions: ['ts', 'tsx', 'js', 'jsx'],
+  coverageDirectory: '../../../coverage/libs/react-spa/bff',
+}
diff --git a/libs/react-spa/bff/project.json b/libs/react-spa/bff/project.json
new file mode 100644
index 000000000000..252e6f2aab94
--- /dev/null
+++ b/libs/react-spa/bff/project.json
@@ -0,0 +1,19 @@
+{
+  "name": "react-spa-bff",
+  "$schema": "../../../node_modules/nx/schemas/project-schema.json",
+  "sourceRoot": "libs/react-spa/bff/src",
+  "projectType": "library",
+  "tags": ["lib:react-spa", "scope:react-spa"],
+  "targets": {
+    "lint": {
+      "executor": "@nx/eslint:lint"
+    },
+    "test": {
+      "executor": "@nx/jest:jest",
+      "outputs": ["{workspaceRoot}/coverage/{projectRoot}"],
+      "options": {
+        "jestConfig": "libs/react-spa/bff/jest.config.ts"
+      }
+    }
+  }
+}
diff --git a/libs/react-spa/bff/src/index.ts b/libs/react-spa/bff/src/index.ts
new file mode 100644
index 000000000000..d535a9f34f45
--- /dev/null
+++ b/libs/react-spa/bff/src/index.ts
@@ -0,0 +1,4 @@
+export * from './lib/BffProvider'
+export * from './lib/bff.hooks'
+export * from './lib/bff.utils'
+export * from './lib/bff.mocks'
diff --git a/libs/react-spa/bff/src/lib/BffContext.tsx b/libs/react-spa/bff/src/lib/BffContext.tsx
new file mode 100644
index 000000000000..dc8657b37e92
--- /dev/null
+++ b/libs/react-spa/bff/src/lib/BffContext.tsx
@@ -0,0 +1,15 @@
+import { createContext } from 'react'
+
+import { BffReducerState } from './bff.state'
+
+export type BffContextType = BffReducerState & {
+  signIn(): void
+  signOut(): void
+  switchUser(nationalId?: string): void
+  bffUrlGenerator(
+    relativePath?: string,
+    params?: Record<string, string>,
+  ): string
+}
+
+export const BffContext = createContext<BffContextType | undefined>(undefined)
diff --git a/libs/react-spa/bff/src/lib/BffPoller.tsx b/libs/react-spa/bff/src/lib/BffPoller.tsx
new file mode 100644
index 000000000000..223640bcdaf8
--- /dev/null
+++ b/libs/react-spa/bff/src/lib/BffPoller.tsx
@@ -0,0 +1,97 @@
+import { usePolling } from '@island.is/react-spa/shared'
+import { BffUser } from '@island.is/shared/types'
+import { ReactNode, useCallback, useEffect, useMemo } from 'react'
+import {
+  BffBroadcastEvents,
+  useBff,
+  useBffBroadcaster,
+  useUserInfo,
+} from './bff.hooks'
+import { isNewSession } from './bff.utils'
+
+type BffPollerProps = {
+  children: ReactNode
+  newSessionCb(): void
+  pollIntervalMS?: number
+}
+
+/**
+ * BffPoller component continuously polls the user's session
+ * information from the backend and broadcasts session changes across tabs
+ * or windows using the BroadcastChannel API. It checks for changes in the
+ * user's session data and triggers appropriate actions like displaying a
+ * session expired modal when necessary.
+ *
+ * Features:
+ * - Polls the backend at a specified interval to fetch user session data.
+ * - If the user's session expires or the backend returns an error, it
+ *   automatically triggers a sign-in process.
+ * - If a change in user session (e.g., a new session ID) is detected, it
+ *   broadcasts a message to all open tabs/windows and triggers the provided
+ *   `newSessionCb` callback to handle the current tab/window.
+ *
+ * @param newSessionCb - Callback function to be called when a new session is detected.
+ * @param pollIntervalMS - Polling interval in milliseconds. Default is 10000ms.
+ *
+ * @usage:
+ * Wrap your application's root component with BffPoller to continuously
+ * monitor the user's session and keep session state synchronized across
+ * multiple tabs/windows.
+ */
+export const BffPoller = ({
+  children,
+  newSessionCb,
+  pollIntervalMS = 10000,
+}: BffPollerProps) => {
+  const { signIn, bffUrlGenerator } = useBff()
+  const userInfo = useUserInfo()
+  const { postMessage } = useBffBroadcaster()
+
+  const url = useMemo(
+    () => bffUrlGenerator('/user', { refresh: 'true' }),
+    [bffUrlGenerator],
+  )
+
+  const fetchUser = useCallback(async () => {
+    const res = await fetch(url, {
+      credentials: 'include',
+    })
+
+    if (!res.ok) {
+      signIn()
+
+      return
+    }
+
+    return res.json() as Promise<BffUser>
+  }, [url, signIn])
+
+  // Poll user data every 10 seconds
+  const { data: newUser, error } = usePolling({
+    fetcher: fetchUser,
+    intervalMs: pollIntervalMS,
+    waitToStartMS: 5000,
+  })
+
+  useEffect(() => {
+    if (error) {
+      // If user polling fails, likely due to 401, then sign in.
+      signIn()
+    } else if (newUser) {
+      // If session has changed (e.g. delegation switch), then notifiy tabs/windows/iframes and execute the callback.
+      if (isNewSession(newUser, userInfo)) {
+        // Note! The tab, window, or iframe that sends this message will not receive it.
+        // This is because the BroadcastChannel API does not broadcast messages to the sender.
+        // Therefore we need to manually handle the new session in the current tab/window, by calling the newSessionCb().
+        postMessage({
+          type: BffBroadcastEvents.NEW_SESSION,
+          userInfo: newUser,
+        })
+
+        newSessionCb()
+      }
+    }
+  }, [newUser, error, userInfo, signIn, postMessage, newSessionCb])
+
+  return children
+}
diff --git a/libs/react-spa/bff/src/lib/BffProvider.tsx b/libs/react-spa/bff/src/lib/BffProvider.tsx
new file mode 100644
index 000000000000..b04a1a6143be
--- /dev/null
+++ b/libs/react-spa/bff/src/lib/BffProvider.tsx
@@ -0,0 +1,237 @@
+import { useEffectOnce } from '@island.is/react-spa/shared'
+import { ReactNode, useCallback, useEffect, useReducer, useState } from 'react'
+
+import { LoadingScreen } from '@island.is/react/components'
+import { BffContext } from './BffContext'
+import { BffPoller } from './BffPoller'
+import { BffSessionExpiredModal } from './BffSessionExpiredModal'
+import { ErrorScreen } from './ErrorScreen'
+import { BffBroadcastEvents, useBffBroadcaster } from './bff.hooks'
+import { ActionType, LoggedInState, initialState, reducer } from './bff.state'
+import { createBffUrlGenerator, isNewSession } from './bff.utils'
+
+const BFF_SERVER_UNAVAILABLE = 'BFF_SERVER_UNAVAILABLE'
+
+type BffProviderProps = {
+  children: ReactNode
+  /**
+   * The base path of the application.
+   */
+  applicationBasePath: string
+  mockedInitialState?: LoggedInState
+}
+
+export const BffProvider = ({
+  children,
+  applicationBasePath,
+  mockedInitialState,
+}: BffProviderProps) => {
+  const [showSessionExpiredScreen, setSessionExpiredScreen] = useState(false)
+  const bffUrlGenerator = createBffUrlGenerator(applicationBasePath)
+  const [state, dispatch] = useReducer(
+    reducer,
+    mockedInitialState ?? initialState,
+  )
+
+  const { authState } = state
+  const showErrorScreen = authState === 'error'
+  const showLoadingScreen =
+    authState === 'loading' ||
+    authState === 'switching' ||
+    authState === 'logging-out'
+  const isLoggedIn = authState === 'logged-in'
+
+  const { postMessage } = useBffBroadcaster((event) => {
+    if (
+      isLoggedIn &&
+      event.data.type === BffBroadcastEvents.NEW_SESSION &&
+      isNewSession(state.userInfo, event.data.userInfo)
+    ) {
+      setSessionExpiredScreen(true)
+    } else if (event.data.type === BffBroadcastEvents.LOGOUT) {
+      // We will wait 1 seconds before we dispatch logout action.
+      // The reason is that IDS will not log the user out immediately.
+      // Note! The bff poller may have triggered logout by that time anyways.
+      setTimeout(() => {
+        dispatch({
+          type: ActionType.LOGGED_OUT,
+        })
+
+        signIn()
+      }, 1000)
+    }
+  })
+
+  useEffect(() => {
+    if (isLoggedIn) {
+      // Broadcast to all tabs/windows/iframes that a new session has started
+      postMessage({
+        type: BffBroadcastEvents.NEW_SESSION,
+        userInfo: state.userInfo,
+      })
+    }
+  }, [postMessage, state.userInfo, isLoggedIn])
+
+  const checkLogin = async (noRefresh = false) => {
+    dispatch({
+      type: ActionType.SIGNIN_START,
+    })
+
+    try {
+      const url = bffUrlGenerator('/user', {
+        refresh: noRefresh.toString(),
+      })
+
+      const res = await fetch(url, {
+        credentials: 'include',
+      })
+
+      if (!res.ok) {
+        // Bff server is down
+        if (res.status >= 500) {
+          throw new Error(BFF_SERVER_UNAVAILABLE)
+        }
+
+        // For other none ok responses, like 401/403, proceed with sign-in redirect.
+        signIn()
+
+        return
+      }
+
+      const user = await res.json()
+
+      dispatch({
+        type: ActionType.SIGNIN_SUCCESS,
+        payload: user,
+      })
+    } catch (error) {
+      dispatch({
+        type: ActionType.ERROR,
+        payload: error,
+      })
+    }
+  }
+
+  const signIn = useCallback(() => {
+    dispatch({
+      type: ActionType.SIGNIN_START,
+    })
+
+    window.location.href = bffUrlGenerator('/login', {
+      target_link_uri: window.location.href,
+    })
+  }, [bffUrlGenerator])
+
+  const signOut = useCallback(() => {
+    if (!state.userInfo) {
+      return
+    }
+
+    dispatch({
+      type: ActionType.LOGGING_OUT,
+    })
+
+    // Broadcast to all tabs/windows/iframes that the user is logging out
+    postMessage({
+      type: BffBroadcastEvents.LOGOUT,
+    })
+
+    window.location.href = bffUrlGenerator('/logout', {
+      sid: state.userInfo.profile.sid,
+    })
+  }, [bffUrlGenerator, postMessage, state.userInfo])
+
+  const switchUser = (nationalId?: string) => {
+    dispatch({
+      type: ActionType.SWITCH_USER,
+    })
+
+    window.location.href = bffUrlGenerator(
+      '/login',
+      nationalId
+        ? {
+            login_hint: nationalId,
+          }
+        : {
+            prompt: 'select_account',
+          },
+    )
+  }
+
+  const checkQueryStringError = () => {
+    const urlParams = new URLSearchParams(window.location.search)
+    const error = urlParams.get('bff_error_code')
+    const errorDescription = urlParams.get('bff_error_description')
+
+    if (error) {
+      dispatch({
+        type: ActionType.ERROR,
+        payload: new Error(`${error}: ${errorDescription}`),
+      })
+    }
+
+    // Returns true if there is an error
+    return !!error
+  }
+
+  useEffectOnce(() => {
+    const hasError = checkQueryStringError()
+
+    if (!hasError && !isLoggedIn) {
+      checkLogin()
+    }
+  })
+
+  const newSessionCb = useCallback(() => {
+    setSessionExpiredScreen(true)
+  }, [])
+
+  const onRetry = () => {
+    window.location.href = applicationBasePath
+  }
+
+  const renderContent = () => {
+    if (mockedInitialState) {
+      return children
+    }
+
+    if (showErrorScreen) {
+      return (
+        <ErrorScreen
+          onRetry={onRetry}
+          {...(state?.error?.message === BFF_SERVER_UNAVAILABLE && {
+            title: 'Þjónusta liggur niðri',
+          })}
+        />
+      )
+    }
+
+    if (showLoadingScreen) {
+      return <LoadingScreen ariaLabel="Er að vinna í innskráningu" />
+    }
+
+    if (showSessionExpiredScreen) {
+      return <BffSessionExpiredModal onLogin={signIn} />
+    }
+
+    if (isLoggedIn) {
+      return <BffPoller newSessionCb={newSessionCb}>{children}</BffPoller>
+    }
+
+    return null
+  }
+
+  return (
+    <BffContext.Provider
+      value={{
+        ...state,
+        signIn,
+        signOut,
+        switchUser,
+        bffUrlGenerator,
+      }}
+    >
+      {renderContent()}
+    </BffContext.Provider>
+  )
+}
diff --git a/libs/react-spa/bff/src/lib/BffSessionExpiredModal.tsx b/libs/react-spa/bff/src/lib/BffSessionExpiredModal.tsx
new file mode 100644
index 000000000000..0e7e5545568c
--- /dev/null
+++ b/libs/react-spa/bff/src/lib/BffSessionExpiredModal.tsx
@@ -0,0 +1,40 @@
+import { Box, Button, ProblemTemplate } from '@island.is/island-ui/core'
+import { fullScreen } from './ErrorScreen.css'
+
+type BffSessionExpiredModalProps = {
+  /**
+   * Login callback
+   */
+  onLogin(): void
+}
+
+/**
+ * This screen is unfortunately not translated because at this point we don't have a user locale.
+ */
+export const BffSessionExpiredModal = ({
+  onLogin,
+}: BffSessionExpiredModalProps) => (
+  <Box
+    display="flex"
+    justifyContent="center"
+    alignItems="center"
+    padding={[0, 6]}
+    className={fullScreen}
+  >
+    <ProblemTemplate
+      variant="warning"
+      expand
+      tag=""
+      title="Innskráning útrunnin"
+      message={
+        <>
+          Þú hefur skráð þig inn í öðru umboði. Viltu{' '}
+          <Button variant="text" onClick={onLogin}>
+            skrá þig
+          </Button>{' '}
+          aftur inn?
+        </>
+      }
+    />
+  </Box>
+)
diff --git a/libs/react-spa/bff/src/lib/ErrorScreen.css.ts b/libs/react-spa/bff/src/lib/ErrorScreen.css.ts
new file mode 100644
index 000000000000..62d600b0be1b
--- /dev/null
+++ b/libs/react-spa/bff/src/lib/ErrorScreen.css.ts
@@ -0,0 +1,5 @@
+import { style } from '@vanilla-extract/css'
+
+export const fullScreen = style({
+  height: '100vh',
+})
diff --git a/libs/react-spa/bff/src/lib/ErrorScreen.tsx b/libs/react-spa/bff/src/lib/ErrorScreen.tsx
new file mode 100644
index 000000000000..dbb6b48f1ed4
--- /dev/null
+++ b/libs/react-spa/bff/src/lib/ErrorScreen.tsx
@@ -0,0 +1,41 @@
+import { Box, Button, ProblemTemplate } from '@island.is/island-ui/core'
+import { fullScreen } from './ErrorScreen.css'
+
+type ErrorScreenProps = {
+  title?: string
+  /**
+   * Retry callback
+   */
+  onRetry(): void
+}
+
+/**
+ * This screen is unfortunately not translated because at this point we don't have a user locale.
+ */
+export const ErrorScreen = ({
+  title = 'Innskráning mistókst',
+  onRetry,
+}: ErrorScreenProps) => (
+  <Box
+    display="flex"
+    justifyContent="center"
+    alignItems="center"
+    padding={[0, 6]}
+    className={fullScreen}
+  >
+    <ProblemTemplate
+      variant="error"
+      expand
+      tag="Villa"
+      title={title}
+      message={
+        <>
+          Vinsamlegast reyndu aftur síðar.{' '}
+          <Button variant="text" onClick={onRetry}>
+            Reyna aftur
+          </Button>
+        </>
+      }
+    />
+  </Box>
+)
diff --git a/libs/react-spa/bff/src/lib/bff.hooks.ts b/libs/react-spa/bff/src/lib/bff.hooks.ts
new file mode 100644
index 000000000000..b1cf35fa4281
--- /dev/null
+++ b/libs/react-spa/bff/src/lib/bff.hooks.ts
@@ -0,0 +1,127 @@
+import { AuthContext } from '@island.is/auth/react'
+import { BffUser, User } from '@island.is/shared/types'
+import { useContext } from 'react'
+import { BffContext, BffContextType } from './BffContext'
+import { createBroadcasterHook } from '@island.is/react-spa/shared'
+
+/**
+ * Maps an object to a BffUser type.
+ */
+export const mapToBffUser = (input: User): BffUser => {
+  const {
+    profile: {
+      sid,
+      birthdate,
+      nationalId,
+      name,
+      idp,
+      actor,
+      subjectType,
+      delegationType,
+      locale,
+    },
+    scopes,
+  } = input
+
+  // Return a mapped BffUser object
+  return {
+    scopes: scopes || [],
+    profile: {
+      sid: sid || '',
+      birthdate,
+      nationalId,
+      name,
+      idp,
+      actor,
+      subjectType,
+      delegationType,
+      locale,
+    },
+  }
+}
+
+/**
+ * Dynamic hook to get the bff context.
+ */
+export const useDynamicBffHook = (hookName: string): BffContextType => {
+  const bffContext = useContext(BffContext)
+
+  if (!bffContext) {
+    throw new Error(`${hookName} must be used within a BffProvider`)
+  }
+
+  return bffContext
+}
+
+/**
+ * This hook is used to get the BFF authentication context.
+ * It has backward compatibility with AuthContext.
+ */
+export const useAuth = () => {
+  const bffContext = useContext(BffContext)
+  const authContext = useContext(AuthContext)
+
+  if (bffContext) {
+    return bffContext
+  }
+
+  if (authContext) {
+    return authContext
+  }
+
+  const errorMsg = (providerStr: string) =>
+    `useAuth must be used within a ${providerStr}`
+
+  if (!authContext) {
+    throw new Error(errorMsg('AuthProvider'))
+  }
+
+  throw new Error(errorMsg('BffProvider'))
+}
+
+/**
+ * This hook is used to get user information.
+ * It will determine what context to use based on the context that is available.
+ * We will remove support for AuthContext when other clients transition over to BFF.
+ * If AuthContext is being used then we will map the user info to the BffUser type.
+ */
+export const useUserInfo = (): BffUser => {
+  const bffContext = useContext(BffContext)
+  const authContext = useContext(AuthContext)
+
+  if (bffContext?.userInfo) {
+    return bffContext.userInfo
+  } else if (authContext?.userInfo) {
+    return mapToBffUser(authContext.userInfo)
+  }
+
+  throw new Error('User info is not available. Is the user authenticated?')
+}
+
+/**
+ * This hook is used to get the bff url generator.
+ * The bff url generator is used to generate urls for the Bff in a conveinent way.
+ */
+export const useBffUrlGenerator = () =>
+  useDynamicBffHook(useBffUrlGenerator.name).bffUrlGenerator
+
+export const useBff = () => useDynamicBffHook(useBff.name)
+
+export enum BffBroadcastEvents {
+  NEW_SESSION = 'NEW_SESSION',
+  LOGOUT = 'LOGOUT',
+}
+
+type NewSessionEvent = {
+  type: BffBroadcastEvents.NEW_SESSION
+  userInfo: BffUser
+}
+
+type LogoutEvent = {
+  type: BffBroadcastEvents.LOGOUT
+}
+
+export type BffBroadcastEvent = NewSessionEvent | LogoutEvent
+
+export const useBffBroadcaster =
+  createBroadcasterHook<BffBroadcastEvent>('bff_auth_channel')
diff --git a/libs/react-spa/bff/src/lib/bff.mocks.ts b/libs/react-spa/bff/src/lib/bff.mocks.ts
new file mode 100644
index 000000000000..2af096c1b055
--- /dev/null
+++ b/libs/react-spa/bff/src/lib/bff.mocks.ts
@@ -0,0 +1,19 @@
+import { BffUser } from '@island.is/shared/types'
+import { LoggedInState } from './bff.state'
+
+export const createMockedInitialState = (
+  user?: Partial<BffUser>,
+): LoggedInState => ({
+  userInfo: {
+    profile: {
+      name: 'Mock',
+      locale: 'is',
+      nationalId: '0000000000',
+      ...user?.profile,
+    } as BffUser['profile'],
+    scopes: user?.scopes ?? [],
+  },
+  authState: 'logged-in',
+  isAuthenticated: true,
+  error: null,
+})
diff --git a/libs/react-spa/bff/src/lib/bff.state.ts b/libs/react-spa/bff/src/lib/bff.state.ts
new file mode 100644
index 000000000000..d23dfd4b4f30
--- /dev/null
+++ b/libs/react-spa/bff/src/lib/bff.state.ts
@@ -0,0 +1,116 @@
+import { BffUser } from '@island.is/shared/types'
+
+// Defining the possible states for authentication
+export type BffState =
+  | 'logged-out'
+  | 'loading'
+  | 'logged-in'
+  | 'switching'
+  | 'logging-out'
+  | 'error'
+
+export enum ActionType {
+  SIGNIN_START = 'SIGNIN_START',
+  SIGNIN_SUCCESS = 'SIGNIN_SUCCESS',
+  LOGGING_OUT = 'LOGGING_OUT',
+  LOGGED_OUT = 'LOGGED_OUT',
+  SWITCH_USER = 'SWITCH_USER',
+  ERROR = 'ERROR',
+}
+
+type NonLoggedInAuthState = Exclude<BffState, 'logged-in'>
+
+export interface BffReducerStateBase {
+  authState: BffState
+  isAuthenticated: boolean
+  error?: Error | null
+}
+
+// State when the user is not logged in
+export interface NonLoggedInState extends BffReducerStateBase {
+  authState: NonLoggedInAuthState
+  userInfo: null
+}
+
+// State when the user is logged in
+export interface LoggedInState extends BffReducerStateBase {
+  authState: 'logged-in'
+  userInfo: BffUser
+  isAuthenticated: true
+}
+
+export type BffReducerState = NonLoggedInState | LoggedInState
+
+export const initialState: NonLoggedInState = {
+  userInfo: null,
+  authState: 'logged-out',
+  isAuthenticated: false,
+  error: null,
+}
+
+export type Action =
+  | {
+      type:
+        | ActionType.SIGNIN_START
+        | ActionType.LOGGING_OUT
+        | ActionType.LOGGED_OUT
+        | ActionType.SWITCH_USER
+    }
+  | { type: ActionType.SIGNIN_SUCCESS; payload: BffUser }
+  | { type: ActionType.ERROR; payload: Error }
+
+/**
+ * Helper function to reset user-related state when switching users or logging out
+ */
+const resetState = (authState: NonLoggedInAuthState): NonLoggedInState => ({
+  userInfo: null,
+  authState,
+  isAuthenticated: false,
+  error: null,
+})
+
+/**
+ * Reducer function to handle state transitions based on actions
+ */
+export const reducer = (
+  state: BffReducerState,
+  action: Action,
+): BffReducerState => {
+  switch (action.type) {
+    case ActionType.SIGNIN_START:
+      return {
+        ...state,
+        authState: 'loading',
+        userInfo: null,
+      }
+
+    case ActionType.SIGNIN_SUCCESS:
+      return {
+        ...state,
+        userInfo: action.payload,
+        authState: 'logged-in',
+        isAuthenticated: true,
+        error: null,
+      }
+
+    case ActionType.LOGGING_OUT:
+      return resetState('logging-out')
+
+    case ActionType.SWITCH_USER:
+      return resetState('switching')
+
+    case ActionType.ERROR:
+      return {
+        ...state,
+        error: action.payload,
+        authState: 'error',
+        userInfo: null,
+      }
+
+    case ActionType.LOGGED_OUT:
+      return initialState
+
+    default:
+      return state
+  }
+}
diff --git a/libs/react-spa/bff/src/lib/bff.utils.ts b/libs/react-spa/bff/src/lib/bff.utils.ts
new file mode 100644
index 000000000000..1c7ce0f0e1d9
--- /dev/null
+++ b/libs/react-spa/bff/src/lib/bff.utils.ts
@@ -0,0 +1,48 @@
+import { BffUser } from '@island.is/shared/types'
+
+/**
+ * Creates a function that can generate a BFF URLs.
+ *
+ * @usage
+ * const bffBaseUrl = createBffUrlGenerator('/myapplication')
+ * const userUrl = bffBaseUrl('/user') // http://localhost:3010/myapplication/bff/user
+ * const userUrlWithParams = bffBaseUrl('/user', { id: '123' }) // http://localhost:3010/myapplication/bff/user?id=123
+ */
+export const createBffUrlGenerator = (basePath: string) => {
+  const sanitizedBasePath = sanitizePath(basePath)
+  const baseUrl = `${window.location.origin}/${sanitizedBasePath}/bff`
+
+  return (relativePath = '', params?: Record<string, string>) => {
+    const url = `${baseUrl}${relativePath}`
+
+    if (params) {
+      const qs = createQueryStr(params)
+
+      return `${url}${qs ? `?${qs}` : ''}`
+    }
+
+    return url
+  }
+}
+
+/**
+ * Trim any leading and trailing slashes
+ */
+const sanitizePath = (path: string) => path.replace(/^\/+|\/+$/g, '')
+
+/**
+ * Creates a query string from an object
+ */
+export const createQueryStr = (params: Record<string, string>) => {
+  return new URLSearchParams(params).toString()
+}
+
+/**
+ *  This method checks if the user has a new session
+ */
+export const isNewSession = (oldUser: BffUser, newUser: BffUser) => {
+  const oldSid = oldUser.profile.sid
+  const newSid = newUser.profile.sid
+
+  return oldSid && newSid && oldSid !== newSid
+}
diff --git a/libs/react-spa/bff/tsconfig.json b/libs/react-spa/bff/tsconfig.json
new file mode 100644
index 000000000000..4daaf45cd328
--- /dev/null
+++ b/libs/react-spa/bff/tsconfig.json
@@ -0,0 +1,20 @@
+{
+  "compilerOptions": {
+    "jsx": "react-jsx",
+    "allowJs": false,
+    "esModuleInterop": false,
+    "allowSyntheticDefaultImports": true,
+    "strict": true
+  },
+  "files": [],
+  "include": [],
+  "references": [
+    {
+      "path": "./tsconfig.lib.json"
+    },
+    {
+      "path": "./tsconfig.spec.json"
+    }
+  ],
+  "extends": "../../../tsconfig.base.json"
+}
diff --git a/libs/react-spa/bff/tsconfig.lib.json b/libs/react-spa/bff/tsconfig.lib.json
new file mode 100644
index 000000000000..21799b3e6ba3
--- /dev/null
+++ b/libs/react-spa/bff/tsconfig.lib.json
@@ -0,0 +1,24 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "outDir": "../../../dist/out-tsc",
+    "types": [
+      "node",
+
+      "@nx/react/typings/cssmodule.d.ts",
+      "@nx/react/typings/image.d.ts"
+    ]
+  },
+  "exclude": [
+    "jest.config.ts",
+    "src/**/*.spec.ts",
+    "src/**/*.test.ts",
+    "src/**/*.spec.tsx",
+    "src/**/*.test.tsx",
+    "src/**/*.spec.js",
+    "src/**/*.test.js",
+    "src/**/*.spec.jsx",
+    "src/**/*.test.jsx"
+  ],
+  "include": ["src/**/*.js", "src/**/*.jsx", "src/**/*.ts", "src/**/*.tsx"]
+}
diff --git a/libs/react-spa/bff/tsconfig.spec.json b/libs/react-spa/bff/tsconfig.spec.json
new file mode 100644
index 000000000000..25b7af8f6d00
--- /dev/null
+++ b/libs/react-spa/bff/tsconfig.spec.json
@@ -0,0 +1,20 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "outDir": "../../../dist/out-tsc",
+    "module": "commonjs",
+    "types": ["jest", "node"]
+  },
+  "include": [
+    "jest.config.ts",
+    "src/**/*.test.ts",
+    "src/**/*.spec.ts",
+    "src/**/*.test.tsx",
+    "src/**/*.spec.tsx",
+    "src/**/*.test.js",
+    "src/**/*.spec.js",
+    "src/**/*.test.jsx",
+    "src/**/*.spec.jsx",
+    "src/**/*.d.ts"
+  ]
+}
diff --git a/libs/react-spa/shared/src/hooks/useBroadcaster.ts b/libs/react-spa/shared/src/hooks/useBroadcaster.ts
new file mode 100644
index 000000000000..4f409c6bb2cf
--- /dev/null
+++ b/libs/react-spa/shared/src/hooks/useBroadcaster.ts
@@ -0,0 +1,145 @@
+import { useCallback, useEffect, useRef, useState } from 'react'
+
+type UseBroadcasterArgs<T> = {
+  channel: BroadcastChannel
+  onMessage?: (event: MessageEvent<T>) => void
+}
+
+type UseBroadcasterReturn<T> = {
+  postMessage: (message: T) => void
+  error: Error | null
+}
+
+/**
+ * Custom hook to manage communication via a BroadcastChannel.
+ *
+ * This hook:
+ * - Sets up a listener for incoming messages on the provided BroadcastChannel.
+ * - Provides a `postMessage` function to send messages through the BroadcastChannel.
+ * - Handles errors encountered while sending messages.
+ *
+ * @param channel - The BroadcastChannel instance to use for messaging.
+ * @param onMessage - Optional callback function to handle incoming messages.
+ *
+ * @returns An object containing the BroadcastChannel instance, the `postMessage` function, and any errors encountered.
+ */
+export const useBroadcaster = <T>({
+  channel,
+  onMessage,
+}: UseBroadcasterArgs<T>): UseBroadcasterReturn<T> => {
+  const [error, setError] = useState<Error | null>(null)
+  const onMessageRef = useRef(onMessage)
+
+  useEffect(() => {
+    onMessageRef.current = onMessage
+  }, [onMessage])
+
+  const handleBroadcastMessage = useCallback((event: MessageEvent<T>) => {
+    try {
+      onMessageRef.current?.(event)
+    } catch (err) {
+      setError(err as Error)
+    }
+  }, [])
+
+  useEffect(() => {
+    channel.addEventListener('message', handleBroadcastMessage)
+
+    return () => {
+      channel.removeEventListener('message', handleBroadcastMessage)
+    }
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [channel])
+
+  const postMessage = useCallback(
+    (message: T) => {
+      try {
+        channel.postMessage(message)
+      } catch (err) {
+        console.error('Error posting message to BroadcastChannel:', err)
+        setError(err as Error)
+      }
+    },
+    [channel],
+  )
+
+  return {
+    postMessage,
+    error,
+  }
+}
+
+const isTestEnv = process.env.NODE_ENV === 'test'
+
+/**
+ * Factory function to create a custom hook for managing a BroadcastChannel.
+ *
+ * This factory function:
+ * - Creates a new BroadcastChannel instance with the specified channel name.
+ * - Passes the instance to `useBroadcaster` along with the `onMessage` handler if provided.
+ *
+ * @param channelName - The name of the BroadcastChannel to listen to.
+ *
+ * @returns A hook that can be used to manage the BroadcastChannel and handle messages.
+ *
+ * @example
+ *  export enum AuthBroadcastEvents {
+ *    NEW_SESSION = 'NEW_SESSION',
+ *    LOGOUT = 'LOGOUT',
+ *  }
+ *
+ *  type NewSessionEvent = {
+ *    type: AuthBroadcastEvents.NEW_SESSION
+ *    userInfo: User
+ *  }
+ *
+ *  type LogoutEvent = {
+ *    type: AuthBroadcastEvents.LOGOUT
+ *  }
+ *
+ *  export type AuthBroadcastEvent = NewSessionEvent | LogoutEvent
+ *
+ *  export const useAuthBroadcaster = createBroadcasterHook<AuthBroadcastEvent>('auth_channel')
+ *
+ * const MyComponent = () => {
+ *  const { postMessage, error } = useAuthBroadcaster((event) => {
+ *   if (event.data.type === AuthBroadcastEvents.NEW_SESSION) {
+ *    console.log('New session started:', event.data.userInfo)
+ *  }
+ * })
+ *
+ * useEffect(() => {
+ *  postMessage({ type: AuthBroadcastEvents.LOGOUT })
+ * }, [postMessage])
+ */
+export const createBroadcasterHook = <Events>(channelName: string) => {
+  let broadcastChannelInstance: BroadcastChannel | null = null
+
+  // Skip BroadcastChannel initialization in test environment since it is not supported by Jest.
+  if (!isTestEnv) {
+    broadcastChannelInstance = new BroadcastChannel(channelName)
+  }
+
+  return (onMessage?: (event: MessageEvent<Events>) => void) => {
+    if (isTestEnv) {
+      return {
+        postMessage: (message: Events) => {
+          console.warn(
+            'postMessage called in test environment with message: ',
+            message,
+          )
+        },
+        error: null,
+      } as UseBroadcasterReturn<Events>
+    } else if (!broadcastChannelInstance) {
+      throw new Error(
+        'BroadcastChannel is not supported in this environment. Ensure the environment supports BroadcastChannel before using this hook.',
+      )
+    }
+
+    return useBroadcaster<Events>({
+      channel: broadcastChannelInstance,
+      onMessage,
+    })
+  }
+}
diff --git a/libs/react-spa/shared/src/hooks/usePolling.tsx b/libs/react-spa/shared/src/hooks/usePolling.tsx
new file mode 100644
index 000000000000..72d821a62eb9
--- /dev/null
+++ b/libs/react-spa/shared/src/hooks/usePolling.tsx
@@ -0,0 +1,113 @@
+import { useCallback, useEffect, useRef, useState } from 'react'
+
+interface PollingResult<T> {
+  data?: T
+  loading: boolean
+  error: Error | null
+}
+
+type UsePollingProps<T> = {
+  /**
+   * A function that fetches data (returns a promise).
+   */
+  fetcher(): Promise<T>
+  /**
+   * The interval in milliseconds for how often to poll.
+   */
+  intervalMs?: number
+  /**
+   * Optional prop for controlling polling externally.
+   */
+  isCancelledProp?: boolean
+  /**
+   * The time in milliseconds to wait before starting the polling.
+   */
+  waitToStartMS?: number
+}
+
+/**
+ * usePolling is a custom hook for polling data at a specified interval.
+ */
+export const usePolling = <T,>({
+  fetcher,
+  intervalMs = 10000,
+  isCancelledProp,
+  waitToStartMS,
+}: UsePollingProps<T>): PollingResult<T> => {
+  const [data, setData] = useState<T | undefined>(undefined)
+  const [loading, setLoading] = useState(true)
+  const [error, setError] = useState<Error | null>(null)
+  const [shouldPoll, setShouldPoll] = useState(false)
+
+  const intervalIdRef = useRef<ReturnType<typeof setInterval> | null>(null)
+  const isCancelledRef = useRef(false)
+
+  // Sync the external isCancelledProp with the ref to ensure real-time updates
+  useEffect(() => {
+    isCancelledRef.current = !!isCancelledProp
+  }, [isCancelledProp])
+
+  const poll = useCallback(async () => {
+    setLoading(true)
+    try {
+      const result = await fetcher()
+
+      if (!isCancelledRef.current) {
+        setData(result)
+        setError(null)
+      }
+    } catch (err) {
+      if (!isCancelledRef.current) {
+        setError(err as Error)
+      }
+    } finally {
+      setLoading(false)
+    }
+  }, [fetcher])
+
+  useEffect(() => {
+    // The cleanup function sets isCancelled to true to stop polling
+    // If the polling resumes then we set it back to false
+    isCancelledRef.current = false
+
+    if (!shouldPoll) {
+      return
+    }
+
+    // Initial poll
+    poll()
+
+    // Set up the interval for polling
+    intervalIdRef.current = setInterval(poll, intervalMs)
+
+    // Cleanup on unmount or when polling should stop
+    return () => {
+      isCancelledRef.current = true
+
+      if (intervalIdRef.current) {
+        clearInterval(intervalIdRef.current)
+      }
+    }
+  }, [fetcher, intervalMs, shouldPoll, poll])
+
+  useEffect(() => {
+    let timeoutId: ReturnType<typeof setTimeout> | null = null
+
+    if (waitToStartMS) {
+      timeoutId = setTimeout(() => {
+        setShouldPoll(true)
+      }, waitToStartMS)
+    } else {
+      setShouldPoll(true)
+    }
+
+    return () => {
+      // Clear the timeout if the component unmounts before the timeout is reached
+      if (timeoutId) {
+        clearTimeout(timeoutId)
+      }
+    }
+  }, [waitToStartMS])
+
+  return { data, loading, error }
+}
diff --git a/libs/react-spa/shared/src/index.ts b/libs/react-spa/shared/src/index.ts
index 07a912e43525..d5e46c014376 100644
--- a/libs/react-spa/shared/src/index.ts
+++ b/libs/react-spa/shared/src/index.ts
@@ -10,6 +10,8 @@ export * from './lib/messages'
 // hooks
 export * from './hooks/useSubmitting'
 export * from './hooks/useEffectOnce'
+export * from './hooks/usePolling'
+export * from './hooks/useBroadcaster'
 
 // utils
 export * from './utils/getOrganizationSlugFromError'
diff --git a/libs/react/feature-flags/src/lib/context.tsx b/libs/react/feature-flags/src/lib/context.tsx
index c42ec62bc56a..8e5156cf44a3 100644
--- a/libs/react/feature-flags/src/lib/context.tsx
+++ b/libs/react/feature-flags/src/lib/context.tsx
@@ -1,13 +1,13 @@
-import React, { FC, createContext, useContext, useMemo } from 'react'
-import * as ConfigCatJS from 'configcat-js'
 import {
   FeatureFlagClient,
   FeatureFlagUser,
-  SettingValue,
   SettingTypeOf,
+  SettingValue,
   createClientFactory,
 } from '@island.is/feature-flags'
-import { useAuth } from '@island.is/auth/react'
+import { useUserInfo } from '@island.is/react-spa/bff'
+import * as ConfigCatJS from 'configcat-js'
+import React, { FC, createContext, useContext, useMemo } from 'react'
 
 const createClient = createClientFactory(ConfigCatJS)
 
@@ -26,7 +26,7 @@ export interface FeatureFlagContextProviderProps {
 export const FeatureFlagProvider: FC<
   React.PropsWithChildren<FeatureFlagContextProviderProps>
 > = ({ children, sdkKey, defaultUser: userProp }) => {
-  const { userInfo } = useAuth()
+  const userInfo = useUserInfo()
   const featureFlagClient = useMemo(() => {
     return createClient({ sdkKey })
   }, [sdkKey])
diff --git a/libs/service-portal/information/src/components/PersonalInformation/UserOnboardingModal/components/Header.tsx b/libs/service-portal/information/src/components/PersonalInformation/UserOnboardingModal/components/Header.tsx
index 5ac9e305fbe4..ce24187e7999 100644
--- a/libs/service-portal/information/src/components/PersonalInformation/UserOnboardingModal/components/Header.tsx
+++ b/libs/service-portal/information/src/components/PersonalInformation/UserOnboardingModal/components/Header.tsx
@@ -46,7 +46,7 @@ export const OnboardingHeader = ({
       </FocusableBox>
       {!hideClose && (
         <Box display="flex" flexDirection="row" alignItems="center">
-          {user && <UserLanguageSwitcher user={user} />}
+          {user && <UserLanguageSwitcher />}
           <Box
             paddingLeft={5}
             paddingRight={2}
diff --git a/libs/service-portal/information/src/module.tsx b/libs/service-portal/information/src/module.tsx
index 6cef20c02fd5..08f6e9648b48 100644
--- a/libs/service-portal/information/src/module.tsx
+++ b/libs/service-portal/information/src/module.tsx
@@ -8,7 +8,6 @@ import { m } from '@island.is/service-portal/core'
 import { PortalModule } from '@island.is/portals/core'
 import { InformationPaths } from './lib/paths'
 import { Navigate } from 'react-router-dom'
-import { User } from '@island.is/shared/types'
 
 const UserInfoOverview = lazy(() =>
   import('./screens/UserInfoOverview/UserInfoOverview'),
@@ -30,23 +29,23 @@ const UserNotificationsSettings = lazy(() =>
   import('./screens/UserNotifications/UserNotifications'),
 )
 
-const sharedRoutes = (userInfo: User) => [
+const sharedRoutes = (scopes: string[]) => [
   {
     name: m.mySettings,
     path: InformationPaths.SettingsOld,
-    enabled: userInfo.scopes.includes(UserProfileScope.write),
+    enabled: scopes.includes(UserProfileScope.write),
     element: <Navigate to={InformationPaths.Settings} replace />,
   },
   {
     name: m.mySettings,
     path: InformationPaths.Settings,
-    enabled: userInfo.scopes.includes(UserProfileScope.write),
+    enabled: scopes.includes(UserProfileScope.write),
     element: <UserProfileSettings />,
   },
   {
     name: 'Notifications',
     path: InformationPaths.Notifications,
-    enabled: userInfo.scopes.includes(DocumentsScope.main),
+    enabled: scopes.includes(DocumentsScope.main),
     key: 'Notifications',
     element: <Notifications />,
   },
@@ -98,7 +97,7 @@ export const informationModule: PortalModule = {
       enabled: userInfo.scopes.includes(ApiScope.meDetails),
       element: <Spouse />,
     },
-    ...sharedRoutes(userInfo),
+    ...sharedRoutes(userInfo.scopes),
   ],
   companyRoutes: ({ userInfo }) => [
     {
@@ -107,6 +106,6 @@ export const informationModule: PortalModule = {
       enabled: userInfo.scopes.includes(ApiScope.company),
       element: <CompanyInfo />,
     },
-    ...sharedRoutes(userInfo),
+    ...sharedRoutes(userInfo.scopes),
   ],
 }
diff --git a/libs/shared/components/src/auth/UserMenu/UserButton.tsx b/libs/shared/components/src/auth/UserMenu/UserButton.tsx
index 0a8b3909cac6..23b175d72d6b 100644
--- a/libs/shared/components/src/auth/UserMenu/UserButton.tsx
+++ b/libs/shared/components/src/auth/UserMenu/UserButton.tsx
@@ -1,19 +1,17 @@
-import React from 'react'
 import {
+  Box,
   Button,
   Hidden,
   Inline,
   UserAvatar,
-  Box,
 } from '@island.is/island-ui/core'
-import { User } from '@island.is/shared/types'
 import { useLocale } from '@island.is/localization'
+import { useUserInfo } from '@island.is/react-spa/bff'
 import { userMessages } from '@island.is/shared/translations'
-import * as styles from './UserMenu.css'
 import { checkDelegation } from '@island.is/shared/utils'
+import * as styles from './UserMenu.css'
 
 interface UserButtonProps {
-  user: User
   small: boolean
   onClick(): void
   iconOnlyMobile?: boolean
@@ -22,11 +20,11 @@ interface UserButtonProps {
 
 export const UserButton = ({
   onClick,
-  user,
   small,
   iconOnlyMobile = false,
   userMenuOpen,
 }: UserButtonProps) => {
+  const user = useUserInfo()
   const isDelegation = checkDelegation(user)
   const { profile } = user
   const { formatMessage } = useLocale()
@@ -77,7 +75,9 @@ export const UserButton = ({
             {isDelegation ? (
               <>
                 <div className={styles.delegationName}>{profile.name}</div>
-                <div className={styles.actorName}>{profile.actor!.name}</div>
+                {profile?.actor?.name && (
+                  <div className={styles.actorName}>{profile.actor.name}</div>
+                )}
               </>
             ) : (
               profile.name
diff --git a/libs/shared/components/src/auth/UserMenu/UserDelegations.tsx b/libs/shared/components/src/auth/UserMenu/UserDelegations.tsx
index 229260989e8f..b4db29d4d10f 100644
--- a/libs/shared/components/src/auth/UserMenu/UserDelegations.tsx
+++ b/libs/shared/components/src/auth/UserMenu/UserDelegations.tsx
@@ -1,23 +1,20 @@
-import React from 'react'
-import { Stack, Text, SkeletonLoader, Box } from '@island.is/island-ui/core'
-import { User } from '@island.is/shared/types'
+import { Box, Stack } from '@island.is/island-ui/core'
 import { useLocale } from '@island.is/localization'
+import { useAuth, useUserInfo } from '@island.is/react-spa/bff'
 import { userMessages } from '@island.is/shared/translations'
-import { UserTopicCard } from './UserTopicCard'
 import { UserDropdownItem } from './UserDropdownItem'
-import { useAuth } from '@island.is/auth/react'
+import { UserTopicCard } from './UserTopicCard'
 
 interface UserDelegationsProps {
-  user: User
   showActorButton: boolean
   onSwitchUser: (nationalId: string) => void
 }
 
 export const UserDelegations = ({
-  user,
   showActorButton,
   onSwitchUser,
 }: UserDelegationsProps) => {
+  const user = useUserInfo()
   const { formatMessage } = useLocale()
   const { switchUser } = useAuth()
   const actor = user.profile.actor
@@ -28,9 +25,9 @@ export const UserDelegations = ({
         {showActorButton && !!actor && (
           <UserTopicCard
             colorScheme="blue"
-            onClick={() => onSwitchUser(actor?.nationalId)}
+            onClick={() => onSwitchUser(actor.nationalId)}
           >
-            {actor?.name}
+            {actor.name}
           </UserTopicCard>
         )}
         <UserDropdownItem
diff --git a/libs/shared/components/src/auth/UserMenu/UserDropdown.tsx b/libs/shared/components/src/auth/UserMenu/UserDropdown.tsx
index f866a4255585..190a097d32f5 100644
--- a/libs/shared/components/src/auth/UserMenu/UserDropdown.tsx
+++ b/libs/shared/components/src/auth/UserMenu/UserDropdown.tsx
@@ -1,29 +1,29 @@
-import React, { Dispatch, SetStateAction, useEffect, useState } from 'react'
 import {
   Box,
-  Text,
-  ModalBase,
-  UserAvatar,
-  Icon,
-  GridContainer,
   Divider,
+  GridContainer,
   Hidden,
+  Icon,
+  ModalBase,
+  Text,
+  UserAvatar,
 } from '@island.is/island-ui/core'
-import { AuthDelegationType, User } from '@island.is/shared/types'
-import { sharedMessages, userMessages } from '@island.is/shared/translations'
+import { theme } from '@island.is/island-ui/theme'
 import { useLocale } from '@island.is/localization'
-import * as styles from './UserMenu.css'
+import { useUserInfo } from '@island.is/react-spa/bff'
+import { sharedMessages, userMessages } from '@island.is/shared/translations'
+import { AuthDelegationType } from '@island.is/shared/types'
+import { checkDelegation } from '@island.is/shared/utils'
+import cn from 'classnames'
+import { Dispatch, SetStateAction, useEffect, useState } from 'react'
+import { useWindowSize } from 'react-use'
 import { UserDelegations } from './UserDelegations'
 import { UserDropdownItem } from './UserDropdownItem'
-import { UserProfileInfo } from './UserProfileInfo'
 import { UserLanguageSwitcher } from './UserLanguageSwitcher'
-import cn from 'classnames'
-import { theme } from '@island.is/island-ui/theme'
-import { useWindowSize } from 'react-use'
-import { checkDelegation } from '@island.is/shared/utils'
+import * as styles from './UserMenu.css'
+import { UserProfileInfo } from './UserProfileInfo'
 
 interface UserDropdownProps {
-  user: User
   dropdownState: 'open' | 'closed'
   setDropdownState: Dispatch<SetStateAction<'closed' | 'open'>>
   onLogout?: () => void
@@ -34,7 +34,6 @@ interface UserDropdownProps {
 }
 
 export const UserDropdown = ({
-  user,
   dropdownState,
   setDropdownState,
   onSwitchUser,
@@ -43,6 +42,7 @@ export const UserDropdown = ({
   showActorButton,
   showDropdownLanguage,
 }: UserDropdownProps) => {
+  const user = useUserInfo()
   const { formatMessage } = useLocale()
   const isVisible = dropdownState === 'open'
   const onClose = () => {
@@ -127,16 +127,13 @@ export const UserDropdown = ({
             </Box>
           </Box>
           {showDropdownLanguage && (
-            <Hidden above="sm">
-              {<UserLanguageSwitcher user={user} dropdown />}
-            </Hidden>
+            <Hidden above="sm">{<UserLanguageSwitcher dropdown />}</Hidden>
           )}
 
           <Divider />
 
           <Box paddingTop={2}>
             <UserDelegations
-              user={user}
               onSwitchUser={onSwitchUser}
               showActorButton={showActorButton}
             />
diff --git a/libs/shared/components/src/auth/UserMenu/UserLanguageSwitcher.tsx b/libs/shared/components/src/auth/UserMenu/UserLanguageSwitcher.tsx
index 9f3eada03a13..3ed67d33e9ec 100644
--- a/libs/shared/components/src/auth/UserMenu/UserLanguageSwitcher.tsx
+++ b/libs/shared/components/src/auth/UserMenu/UserLanguageSwitcher.tsx
@@ -1,18 +1,17 @@
-import React from 'react'
 import { Box, Button, Select } from '@island.is/island-ui/core'
-import { User, Locale } from '@island.is/shared/types'
 import { useLocale } from '@island.is/localization'
-import { useUpdateUserProfileMutation } from '../../../gen/schema'
+import { useUserInfo } from '@island.is/react-spa/bff'
 import { sharedMessages } from '@island.is/shared/translations'
+import { Locale } from '@island.is/shared/types'
 import { checkDelegation } from '@island.is/shared/utils'
+import { useUpdateUserProfileMutation } from '../../../gen/schema'
 
 export const UserLanguageSwitcher = ({
-  user,
   dropdown = false,
 }: {
-  user: User
   dropdown?: boolean
 }) => {
+  const user = useUserInfo()
   const { lang, formatMessage, changeLanguage } = useLocale()
   const [updateUserProfileMutation] = useUpdateUserProfileMutation()
 
diff --git a/libs/shared/components/src/auth/UserMenu/UserMenu.tsx b/libs/shared/components/src/auth/UserMenu/UserMenu.tsx
index b831fbdf4b32..875b16169a25 100644
--- a/libs/shared/components/src/auth/UserMenu/UserMenu.tsx
+++ b/libs/shared/components/src/auth/UserMenu/UserMenu.tsx
@@ -1,6 +1,6 @@
-import React, { useEffect, useState } from 'react'
 import { Box, Hidden } from '@island.is/island-ui/core'
-import { useAuth } from '@island.is/auth/react'
+import { useAuth } from '@island.is/react-spa/bff'
+import { useEffect, useState } from 'react'
 import { UserButton } from './UserButton'
 import { UserDropdown } from './UserDropdown'
 import { UserLanguageSwitcher } from './UserLanguageSwitcher'
@@ -52,19 +52,16 @@ export const UserMenu = ({
     <Box display="flex" position="relative" height="full">
       {showLanguageSwitcher && (
         <Hidden below="md">
-          <UserLanguageSwitcher user={user} />
+          <UserLanguageSwitcher />
         </Hidden>
       )}
       <UserButton
-        user={user}
         onClick={handleClick}
         small={small}
         iconOnlyMobile={iconOnlyMobile}
         userMenuOpen={userMenuOpen}
       />
-
       <UserDropdown
-        user={user}
         dropdownState={dropdownState}
         setDropdownState={setDropdownState}
         onLogout={() => {
diff --git a/libs/shared/mocking/src/msw/startMocking.ts b/libs/shared/mocking/src/msw/startMocking.ts
index 27baa3ce6c20..9c9b225997bb 100644
--- a/libs/shared/mocking/src/msw/startMocking.ts
+++ b/libs/shared/mocking/src/msw/startMocking.ts
@@ -3,6 +3,22 @@ import { RequestHandler } from 'msw'
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 export declare type RequestHandlersList = RequestHandler<any, any, any, any>[]
 
+const allowedKeyPaths = ['stjornbord', 'minarsidur']
+
+const extractUniqueKeyPath = (url: string) => {
+  try {
+    const parsedUrl = new URL(url)
+    const pathSegments = parsedUrl.pathname
+      .replace(/\/$/, '')
+      .split('/')
+      .filter(Boolean)
+    return pathSegments.length > 0 ? pathSegments[0] : null
+  } catch (error) {
+    // noop
+    return null
+  }
+}
+
 export const startMocking = (requestHandlers: RequestHandlersList) => {
   if (typeof window === 'undefined') {
     // https://github.com/webpack/webpack/issues/8826
@@ -15,10 +31,14 @@ export const startMocking = (requestHandlers: RequestHandlersList) => {
     // eslint-disable-next-line @typescript-eslint/no-var-requires
     const { setupWorker } = require('msw')
     const worker = setupWorker(...requestHandlers)
-    if (location.pathname.split('/')[1] === 'minarsidur') {
+    const keyPath = extractUniqueKeyPath(location.href)
+
+    if (keyPath && allowedKeyPaths.includes(keyPath)) {
+      const normalizedPath = keyPath.endsWith('/') ? keyPath : `${keyPath}/`
+
       worker.start({
         serviceWorker: {
-          url: '/minarsidur/mockServiceWorker.js',
+          url: `/${normalizedPath}mockServiceWorker.js`,
         },
       })
     } else {
diff --git a/libs/shared/types/src/index.ts b/libs/shared/types/src/index.ts
index cb35f1030dd4..66ea2586686e 100644
--- a/libs/shared/types/src/index.ts
+++ b/libs/shared/types/src/index.ts
@@ -10,3 +10,4 @@ export * from './lib/delegation'
 export * from './lib/environment'
 export * from './lib/searchable-content-types'
 export * from './lib/PersonalRepresentativeDelegationType'
+export * from './lib/bff'
diff --git a/libs/shared/types/src/lib/bff.ts b/libs/shared/types/src/lib/bff.ts
new file mode 100644
index 000000000000..436aa0ae8907
--- /dev/null
+++ b/libs/shared/types/src/lib/bff.ts
@@ -0,0 +1,24 @@
+import { AuthDelegationType } from './delegation'
+
+export interface IdTokenClaims {
+  // Session ID
+  sid: string
+  // Birthdate in the format YYYY-MM-DD
+  birthdate?: string
+  nationalId: string
+  name: string
+  // Identity provider
+  idp: string
+  actor?: {
+    nationalId: string
+    name: string
+  }
+  subjectType: 'person' | 'legalEntity'
+  delegationType?: AuthDelegationType[]
+  locale?: string
+}
+
+export type BffUser = {
+  scopes: string[]
+  profile: IdTokenClaims
+}
diff --git a/libs/shared/utils/src/lib/isDelegation.ts b/libs/shared/utils/src/lib/isDelegation.ts
index 9708f075015b..fb36417a6f5d 100644
--- a/libs/shared/utils/src/lib/isDelegation.ts
+++ b/libs/shared/utils/src/lib/isDelegation.ts
@@ -1,5 +1,5 @@
-import { User } from '@island.is/shared/types'
+import { BffUser, User } from '@island.is/shared/types'
 
-export const checkDelegation = (user: User) => {
+export const checkDelegation = (user: User | BffUser) => {
   return Boolean(user?.profile.actor)
 }
diff --git a/libs/testing/nest/src/lib/testServer.ts b/libs/testing/nest/src/lib/testServer.ts
index 00ae8af89a00..fefd302a8214 100644
--- a/libs/testing/nest/src/lib/testServer.ts
+++ b/libs/testing/nest/src/lib/testServer.ts
@@ -3,7 +3,8 @@ import { Test } from '@nestjs/testing'
 import { TestingModuleBuilder } from '@nestjs/testing/testing-module.builder'
 
 import { InfraModule, HealthCheckOptions } from '@island.is/infra-nest-server'
-import bodyParser from 'body-parser'
+
+import cookieParser from 'cookie-parser'
 
 type CleanUp = () => Promise<void> | undefined
 
@@ -74,6 +75,8 @@ export const testServer = async ({
     await beforeServerStart(app)
   }
 
+  app.use(cookieParser())
+
   await app.init()
 
   const hookCleanups = await Promise.all(
diff --git a/tsconfig.base.json b/tsconfig.base.json
index 79b510cb730e..1d7accc38f8c 100644
--- a/tsconfig.base.json
+++ b/tsconfig.base.json
@@ -981,6 +981,7 @@
       "@island.is/portals/shared-modules/delegations/messages": [
         "libs/portals/shared-modules/delegations/src/lib/messages.ts"
       ],
+      "@island.is/react-spa/bff": ["libs/react-spa/bff/src/index.ts"],
       "@island.is/react-spa/shared": ["libs/react-spa/shared/src/index.ts"],
       "@island.is/react/components": ["libs/react/components/src/index.ts"],
       "@island.is/react/feature-flags": [