I have multiple Laravel applications: the main application and the microservice. I use Laravel Passport.

The main application provides API Endpoints for the microservice. Since this involves complaint management, these API Endpoints should be EXCLUSIVELY accessible by the microservice, regardless of the user authenticated via OAuth. It mains that also the mainserice cannot access these API Endpoints.
Because this microservice performs a kind of sovereign task.

Is there a way for the microservice application to authenticate not with the user token as usual via OAuth but with its client secret?

Or better: Both, client secret and user token?