[keycloak-user] Session timeouts for SPA + bearer backend

Hello, I'm having a problem with my SPA Anuglar based application. TD;DR The app's session seems to be valid (cookies) although requests to backend fail since its token has expired - openid-connect/token = HTTP 400 (Refreshing token: token expired). ========================= The app itself is protected with keycloak.js (Access Type: public + Standard Flow: ON + login_required) and the backend is built with Spring Security adapter (Access Type: bearer-only). Everything works fine until I leave the app idle for some time and then resume using it (requesting from backend). When I do so, the backend starts to respond with an eror as its session had timed out - openid-connect/token returns 400. Although, obviously, the session for the app itself hadn't expired yet. As far as I know, there is for instance a KEYCLOAK_SESSION cookie which is checked periodically by keycloak.js. When I remove the cookie manually, it gets checked and the app gets redirected to its login screen. KC version used is 2.2.1.Final. My realm token settings: * Revoke Refresh Token: OFF * SSO Session Idle: 30mins * SSO Session Max: 6days * Offline Session Idle: 30days * Access Token Lifespan: 15mins * ditto for Implicit Flow: 18mins How should I set my app/token settings up to solve this? Should I just force my client to relog as soon as Refreshing token: token expired? Don't know what is the proper way to handle this... Thanks in advance.