BSS App authenticate to external server

My objective is for my BSS app to be able to Login/authenticate to an external server. What is the recommended technique? I am in control of the external server, which is a NodeJS server.

Is it possible to hide/protect login credentials, then access those credentials securely to log into the external server? Other methods of the app to authenticate?

If not, I may have to complete my BSS app, functionally, and then rewire it as the web component of a new node server app, so I can perform my desired authentication from the backend, to perform the logon to the actual external server I’m trying to log in to. I can do that but it would make updating the BSS App’s code a royal pain.

Maybe someone has had a similar need and can guide me here. Thx.