keycloak bearer-only clients: why do they exist? : <p>I am trying to wrap my head around the concept of <code>bearer-only</code> clients in Keycloak.</p>

<p>I understand the concept of public vs confidential and the concept of service accounts and the <code>grant_type=client_credentials</code> stuff. But with <code>bearer-only</code>, I'm stuck.</p>

<p>Googling only reveals fragments of discussions saying:</p>

<blockquote>
  <p>You cannot obtain a token from keycloak with a <code>bearer-only</code> client.</p>
</blockquote>

<p>The docs are unclear as well. All they say is:</p>

<blockquote>
  <p>Bearer-only access type means that the application only allows bearer token requests.</p>
</blockquote>

<p>Ok, if my app only allows bearer token requests, how do I obtain this token if I cannot get it from Keycloak using client id / client secret?</p>

<p>And if you can't obtain a token, what can you at all? Why do these clients exist? Can somebody please provide an example of using this type of client? </p>
