[keycloak-user] Bearer only and client credentials

Hello, According to documentation, the OAuth2 client credentials flow corresponds to the concept of Service Accounts in Keycloak, right? Also, it seems that only confidential clients are allowed to participate in this flow, so this is not an option for bearer-only clients (I also found this issue here https://issues.jboss.org/browse/KEYCLOAK-4156) So, if a bearer-only client needs to access another protected resource regardless of who is calling it, what would be the recommended approach? Do I always need to make sure that any token generated for the bearer-only client also has the permissions for the other proteced resource? Or is there a way to make the bearer-only client get a token on it's own behalf? Did anyone else had this problem and used some sort of workaround to get the token for the bearer-only client? Thanks, Marcelo Nardelli