diff --git a/apps/self-service/src/app/app.config.ts b/apps/self-service/src/app/app.config.ts
index a4b7577..c60e7bf 100644
--- a/apps/self-service/src/app/app.config.ts
+++ b/apps/self-service/src/app/app.config.ts
@@ -14,9 +14,11 @@ export interface RuntimeConfig {
 }
 
 /**
- * Build the app providers from runtime config. `redirectUrl` and `secureApiOrigin` are the app's own
- * origin: the app is served same-origin as the BFF (nginx proxies /self-service + /openbaar), so the
- * api-client's relative calls stay same-origin and the token interceptor attaches to them.
+ * Build the app providers from runtime config. `redirectUrl` is the app's own origin (where Keycloak
+ * redirects back). The app is served same-origin as the BFF (nginx proxies /self-service + /openbaar),
+ * so the api-client uses **relative** URLs — hence `secureRoutes` is the relative `/self-service/`
+ * prefix (the guarded BFF route), not the origin: the interceptor matches on `req.url`, which stays
+ * relative, so an origin would never match and the token would not be attached.
  */
 export function appConfig(runtime: RuntimeConfig): ApplicationConfig {
   const origin = typeof window !== 'undefined' ? window.location.origin : '/';
@@ -28,7 +30,7 @@ export function appConfig(runtime: RuntimeConfig): ApplicationConfig {
       provideDigiadAuth({
         authority: runtime.authority,
         redirectUrl: origin,
-        secureApiOrigin: origin,
+        secureRoutes: ['/self-service/'],
       }),
     ],
   };
diff --git a/libs/auth/src/lib/digid-auth.providers.ts b/libs/auth/src/lib/digid-auth.providers.ts
index 0f1cb21..15f5ec2 100644
--- a/libs/auth/src/lib/digid-auth.providers.ts
+++ b/libs/auth/src/lib/digid-auth.providers.ts
@@ -13,8 +13,13 @@ export interface DigiadAuthOptions {
   authority: string;
   /** Where Keycloak redirects back to after login (usually the app origin). */
   redirectUrl: string;
-  /** The BFF origin whose requests get the bearer token attached (secure route). */
-  secureApiOrigin: string;
+  /**
+   * Route prefixes whose requests get the bearer token attached. The api-client calls the BFF with
+   * **relative** URLs (same-origin via the nginx proxy), so these must be relative path prefixes
+   * (e.g. `/self-service/`) — angular-auth-oidc-client matches `req.url.startsWith(route)`, and a
+   * relative `req.url` never starts with an absolute origin.
+   */
+  secureRoutes: string[];
 }
 
 /**
@@ -35,7 +40,7 @@ export function provideDigiadAuth(options: DigiadAuthOptions): EnvironmentProvid
           responseType: 'code',
           silentRenew: true,
           useRefreshToken: true,
-          secureRoutes: [options.secureApiOrigin],
+          secureRoutes: options.secureRoutes,
           logLevel: LogLevel.Warn,
         },
       },