SAP integration suite odata api proxy to the api portal backend service

Question

I have installed the API Proxy packaged on my trail (on us10) instance of SAP Integration suite.

https://api.sap.com/api/APIPortal_APIProxy_CF/overview

It is a proxy to:

https://us10apiportal.cfapps.us10.hana.ondemand.com/apiportal/api/1.0/Management.svc

According to the documentation this backend system use oAuth2

But how do this work?

Does it have its own authentication server or do I create one in either SAP BTP Cockpit or as a proxy in the SAP Integration Suite?

If is has it's own, what is my client/secret? If I have to create a auth server myself - how is that linked to the backend system or is it all passed in the token?

I have not been able to find a step be step guide on this.

I'll be pleased if someone can help me on this one.