anchor.diff:          // use tokens.getAccessToken() to configure MP RestClient Authorization header/etc
       }
   }
  -```
  +----
   
   === Use OidcClient in MicroProfile RestClient client filter
   
   `quarkus-oidc-client-filter` extension provides `io.quarkus.oidc.client.filter.OidcClientRequestFilter` JAX-RS ClientRequestFilter which uses `OidcClient` to acquire the access token, refresh it if needed, and set it as an HTTP `Authorization` `Bearer` scheme value.
   
  -By default this filter will get `OidcClient` to acquire the first pair of access and refresh tokens at its initialization time. If the access tokens are short lived and refresh tokens are not available then the token acquisition should be delayed with `quarkus.oidc-client.early-tokens-acquisition=false`.
  +By default, this filter will get `OidcClient` to acquire the first pair of access and refresh tokens at its initialization time. If the access tokens are short-lived and refresh tokens are not available then the token acquisition should be delayed with `quarkus.oidc-client.early-tokens-acquisition=false`.
   
   You can selectively register `OidcClientRequestFilter` by using either `io.quarkus.oidc.client.filter.OidcClientFilter` or `org.eclipse.microprofile.rest.client.annotation.RegisterProvider` annotations:
   
  -```
  +[source,java]
  +----
   import org.eclipse.microprofile.rest.client.inject.RegisterRestClient;
   import io.quarkus.oidc.client.filter.OidcClientFilter;
   
  
positive.code:     @GET
      String getUserName();
  }
  ```
  
  Alternatively, `AccessTokenRequestFilter` can be registered automatically with all MP Rest or JAX-RS clients if `quarkus.oidc-token-propagation.register-filter=true` property is set.
  
  
negative.code: 
  == OidcClient
  
  `quarkus-oidc-client` extension provides a reactive `io.quarkus.oidc.client.OidcClient` which can be used to acquire and refresh tokens using SmallRye Mutiny `Uni` and `Vert.x WebClient`.
  
  `OidcClient` is initialized at the build time with the IDP token endpoint URL which can be auto-discovered or manually configured and uses this endpoint to acquire access tokens using `client_credentials` or `password` token grants and refresh the tokens using `refresh_token` grant.
  
  Here is how `OidcClient` can be configured to use the `client_credentials` grant:
  
  [source,properties]
  ----
  quarkus.oidc-client.auth-server-url=${keycloak.url}/realms/quarkus2/
  quarkus.oidc-client.client-id=quarkus-app
  quarkus.oidc-client.credentials.secret=secret
  ----
  
  Here is how `OidcClient` can be configured to use the `password` grant:
  
  [source,properties]
  ----
  quarkus.oidc-client.auth-server-url=${keycloak.url}/realms/quarkus2/
  quarkus.oidc-client.client-id=quarkus-app
  quarkus.oidc-client.credentials.secret=secret
  quarkus.oidc-client.grant.type=password
  quarkus.oidc-client.grant-options.password.username=alice
  quarkus.oidc-client.grant-options.password.password=alice
  ----
  In both cases `OidcClient` will auto-discover the token endpoint URL and use it to acquire the tokens.
  
  === Use OidcClient directly
  
  One can use `OidcClient` directly as follows:
  
  [source,java]
  ----
  import javax.inject.PostConstruct;
  import javax.inject.Inject;
  import javax.ws.rs.GET;
  