Once you have secured you APIs, what is most secure method of accessing those APIs from the front end? I seen a SPA app being utilised to access the APIs but is that the correct way?
SPAs are certainly common in terms of front end applications accessing APIs, and we do have a large library of documentation, SDKs, etc. around these frameworks. To answer your question, a SPA can absolutely access an API securely by conforming to OAuth protocols. The following resources may be of use: