There are two ways of doing that now: Getting token via implicit flow (introduced in 1.9.2) or via Token Exchange (introduced in 3.4.0). I've described them both in https://blog.softwaremill.com/who-am-i-keycloak-impersonation-api-bfe7acaf051a -- Sent from: http://keycloak-user.88327.x6.nabble.com/