Hi there @abroadhurst welcome back!
SPAs are certainly common in terms of front end applications accessing APIs, and we do have a large library of documentation, SDKs, etc. around these frameworks. To answer your question, a SPA can absolutely access an API securely by conforming to OAuth protocols. The following resources may be of use:
Hope this helps!