Access Token has to be generated from a different client than the authorization one for the ResourceGuard

[patostickar]

May not be a library specific bug, but after hours of investigation, I found that if you grant an Access Token from a client, you can't use it to handle the authorization of resources for the same client.

That is the reason why in the example there is a postman client for login, and a nest-api for authorization.

Is this an OpenID specification, or a bug in Keycloak?

[ferrerojosh]

Guarding resources is related to Keycloak's authz, I am not sure how it accepts access tokens, maybe it has something to do with the auth server configuration ?