title: Why access token from Flask-OIDC extension isn't valid for keycloak GET /users endpoint?
body: <p>I'm trying reach the list of realm users from keycloak server and I don't understand why token from <a href="https://flask-oidc.readthedocs.io/en/latest/" rel="nofollow noreferrer">Flask-OIDC</a> in-build <code>get_access_token()</code> method doesn't work for me.</p>
  <p>When I'm using token from request as described below everything is fine:</p>
  <pre><code>body_dict = {
      'grant_type': 'client_credentials',
      'client_id': client_secrets['web']['client_id'],
      'client_secret': client_secrets['web']['client_secret']
  }
  
  headers = {
      'Content-Type': 'application/x-www-form-urlencoded'
  }
  
  _, content = Http().request(
      uri=client_secrets['web']['token_uri'],
      method='POST',
      headers=headers,
      body=urlencode(body_dict)
  )
  
  token = json.loads(content.decode('utf-8'))['access_token']
  </code></pre>
  <p>but when <code>token = openid_connect.get_access_token()</code> I'm receiving <code>{&quot;error&quot;:&quot;HTTP 401 Unauthorized&quot;}</code></p>
  <p>this is my client_secrets.json file:</p>
  <pre><code>{
    &quot;web&quot;: {
      &quot;auth_uri&quot;: &quot;http://localhost:8080/auth/realms/my_realm/protocol/openid-connect/auth&quot;,
      &quot;client_id&quot;: &quot;tracker&quot;,
      &quot;client_secret&quot;: &quot;b76d7cfb-02d7-4c7b-8fd8-85604e620e1a&quot;,
      &quot;redirect_uris&quot;: [
        &quot;http://localhost:9000/oidc_callback&quot;
      ],
      &quot;userinfo_uri&quot;: &quot;http://keycloak:8080/auth/realms/my_realm/protocol/openid-connect/userinfo&quot;,
      &quot;token_uri&quot;: &quot;http://keycloak:8080/auth/realms/my_realm/protocol/openid-connect/token&quot;,
      &quot;token_introspection_uri&quot;: &quot;http://keycloak:8080/auth/realms/my_realm/protocol/openid-connect/token/introspect&quot;
    }
  }
  </code></pre>
  <p>token from <code>get_access_token()</code> method:</p>
  <pre><code>{
    &quot;exp&quot;: 1627897825,
    &quot;iat&quot;: 1627897525,
    &quot;auth_time&quot;: 1627897525,
    &quot;jti&quot;: &quot;6456732f-d1ac-4d3f-91c9-b3fb1f40f756&quot;,
    &quot;iss&quot;: &quot;http://localhost:8080/auth/realms/my_realm&quot;,
    &quot;aud&quot;: [
      &quot;realm-management&quot;,
      &quot;account&quot;
    ],
    &quot;sub&quot;: &quot;abeea329-1e46-472d-9474-56bffe111701&quot;,
    &quot;typ&quot;: &quot;Bearer&quot;,
    &quot;azp&quot;: &quot;tracker&quot;,
    &quot;session_state&quot;: &quot;9e2a7d90-b04c-4d4b-b2c3-ea8e76dab9a8&quot;,
    &quot;acr&quot;: &quot;1&quot;,
    &quot;realm_access&quot;: {
      &quot;roles&quot;: [
        &quot;default-roles-my_realm&quot;,
        &quot;offline_access&quot;,
        &quot;uma_authorization&quot;
      ]
    },
    &quot;resource_access&quot;: {
      &quot;realm-management&quot;: {
        &quot;roles&quot;: [
          &quot;view-users&quot;,
          &quot;query-groups&quot;,
          &quot;query-users&quot;
        ]
      },
      &quot;tracker&quot;: {
        &quot;roles&quot;: [
          &quot;tracker_role_admin&quot;
        ]
      },
      &quot;account&quot;: {
        &quot;roles&quot;: [
          &quot;manage-account&quot;,
          &quot;manage-account-links&quot;,
          &quot;view-profile&quot;
        ]
      }
    },
    &quot;scope&quot;: &quot;openid email profile&quot;,
    &quot;email_verified&quot;: false,
    &quot;name&quot;: &quot;admin_firstname admin_lastname&quot;,
    &quot;preferred_username&quot;: &quot;tracker_admin&quot;,
    &quot;given_name&quot;: &quot;admin_firstname&quot;,
    &quot;family_name&quot;: &quot;admin_lastname&quot;,
    &quot;email&quot;: &quot;admin@domain.com&quot;
  }
  </code></pre>
  <p>Is it not working for some obvious reason? Maybe <code>Flask-OIDC</code> using password grant_type to reach the token? I didn't found specified grant_type in <code>OpenIDConnect</code> object source code only that it's saving token in mysterious <code>g</code> object from <code>flask</code> module.</p>
  <p>Thank you in advance!</p>