@tiny-lamp6590 yes, I believe you do need your own back end for token exchange.
I've now written my own, there are some gotcha's when using the React SDK with your custom built auth server. You have to ensure that you drop the following cookie:
app.at_exp - otherwise you isAuthenticated will show as false.