For Django, there's also django-bridge. This lets you build React apps that are backed by Django views/routing. You can also use Django's built-in authentication and forms which isn't easy with APIs.
But it's also really not that difficult. Auth just takes a lot of practice for people to grok so most people don't want to touch it.
I'll open source something once we're done solving the problem cleanly at my company.
The actual authentication remains on the Django app, using the standard way of POSTing to a login form and receiving a session cookie -- only instead of a server-generated page serving a HTML form, you have the PWA lipstick sending data directly. This approach is so much simpler than dealing with id/access/refresh tokens, encryption keys, black lists, and all of the OIDC dance.