Proxy to secure APIs and web applications?

Question

User identification

We have several dozen web services with REST APIs, plus several web applications that use these APIs. There is also an OpenId Connect server (MitreId implementation). I would like to achieve the following behavior:

1. when a user visits one of our web applications, they are redirected to the Open Id Connect authentication page. The access token must be stored in cookies, not in the Authorization header.
   
2. when the user tries to use the API with e.g. curl, he must provide the correct token
   
3. want to avoid modifications to our frontends and backends
   
4. boxed solutions (for example, configs for apache or nginx as a proxy) are welcome