title: keycloak bearer-only clients: why do they exist?
body: <p>I am trying to wrap my head around the concept of <code>bearer-only</code> clients in Keycloak.</p>
  
  <p>I understand the concept of public vs confidential and the concept of service accounts and the <code>grant_type=client_credentials</code> stuff. But with <code>bearer-only</code>, I'm stuck.</p>
  
  <p>Googling only reveals fragments of discussions saying:</p>
  
  <blockquote>
    <p>You cannot obtain a token from keycloak with a <code>bearer-only</code> client.</p>
  </blockquote>
  
  <p>The docs are unclear as well. All they say is:</p>
  
  <blockquote>
    <p>Bearer-only access type means that the application only allows bearer token requests.</p>
  </blockquote>
  
  <p>Ok, if my app only allows bearer token requests, how do I obtain this token if I cannot get it from Keycloak using client id / client secret?</p>
  
  <p>And if you can't obtain a token, what can you at all? Why do these clients exist? Can somebody please provide an example of using this type of client? </p>