[keycloak-user] How should my application users get a token to directly access my API?

[Geoffrey Cleaves]

Let's say that in addition to letting my end users access my REST API via
the single page web app, I also want to let the end users access the REST
API in a machine-to-machine fashion. So that, for example, the end user
could run a report every night automatically via cron/curl instead of
generating the report via the front end SPA.

My SPA gets tokens using keycloak.js and the Authorizaton Code Flow. But I
don't think this is appropriate for the scenario above. Curl can't be
entering a username/password into Keycloak's login page when a session
expires. Are my end users to use the Resource Owner Password Credentials
Grant? If so, which clientid/secret should be used?

Thanks for shedding light on this.

Geoff