[keycloak-user] Using a service account for an app

Hi, Sorry I am a little bit confused on how to use a service account. And if I am doing this correctly. I was reading this https://keycloak.gitbooks.io/server-adminstration-guide/content/topics/cl... So at the moment I have a java rest api backend that is set as an access type bearer-only, a front end in angular 1.5 that is a public access type. And they work ok with keycloak. So I am creating a third app (it is not web), in java. I want this app to be able to access my rest services without logging in or creating public services. So for what I understand I should create client of type confidential, and allow services accounts. So here is the part that I am a kind of lost. I only have one role called users, that I was using on my backend and front end. Should I create a new role for my app, and should I add this role on my backend? Thanks