[keycloak-user] Keycloak - Token access for external customer server

Hi all I am new to Keycloak SSO, and have been trying to setup a POC for a simple microservice environment: user -> public client 1 -> service 1 user -> public client 2 -> service 1 public client 1, 2 and service 1 are all Keycloak clients, service 1 is bearer only. They are all spring boot with Keycloak-spring-boot-starter and all user info, attributes and roles/auth comes from Keycloak and spring use these roles/auth to perform @PreAuthorize and path access control. Now I want to introduce a new path, public client 3, for non browser API access by my customers: customer server -> public client 3 -> service 1 My questions: - Should customer server get token from Keycloak with client_credentials grant, then access public client 3 with token? ie customer server is a client on Keycloak. - if no: Is Keycloak the right technology to use here, for granting token of API access? what are the alternatives? - if yes: I find Keycloak will create a temporary user, called 'service-account-public client 3' and email 'service-account-public client 3(a)placeholder.org'. This user is deleted after session expired. As I use email address for spring jpa audit, is there a way to change these default attributes? Regards KL