So you need to get an access token by validating against a third-party (keycloak, auth0) to access your own API? That's a pain.