this is a wonderful article that I think answers your question https://betweendata.io/posts/secure-spring-rest-api-using-keycloak/