Hi!
The use of the OIDC Authentication method is the correct way to protect your API, however please understand that the intent is that you are protecting a Resource API, it is expected that the OIDC Authentication flow has already been performed elsewhere and you are expected to use the resulting access token obtained via that Authentication in the API call. It is not expected that the API call would trigger the authorization flow, as it is merely a resource server.
Triggering the Authorization flow and obtaining the Access Token is outside the scope of the OIDC authentication method offered in the API Designer.
Hope that helps and makes sense.
Best Regards,
Chris