I have a following setup: microservices that run on k8s that are a part of a single app, a gateway that all the cross service and client-service communication go through, which validates the tokens that get passed via the requests and Keycloak, that issues the token. I have a Keycloak client for the gateway such that the user will provide the username and password and login via the Keycloak UI, with the standart OidC flow. What I am stuck at is cross-service communication. I want the scopes, roles and resources of client-service and service-service communication to be unified. From what I know, M2M communication is implemented via the Client credential grant type. Now that means that if I want fine-grained access control per service I need a client per service, because each service which have it own services it can access and not all of them and so the only way to do it as far as I know is to implement different scopes and resources for different clients. However, if I do create a client for each service, then I have a problem where the resources are not global but client scoped and so I can’t have unified, synced resources for all clients. Also from what I understand Clients in Keycloak represents the resources / application we access, and so we need different clients for each service. So for example if I have service A that access B and C, then I need to create a client “A to B” and also “A to C” and that just grown exponentially. I feel like I am missing something. How can I resolve the issues I described?