[keycloak-user] Microservices Auth with Keycloak

We are implementing a micro services architecture with services written in Spring/Vertx and .NET Core. So essentially these services are Resource Servers protecting resources and according to documentation resource servers are also clients in Keycloak. We have a few front end apps and 2 mobile apps for android and iphone which will also be clients in Keycloak. Questions 1) Should the front end apps and mobile apps be public client in Keycloak? 2) If each micro service which is a resource server is a client with credentials, how does access token generated for single clientid work across multiple micro services? Not sure how to tie it all together, thanks for your help. Chirdeep