# Client credentials grant: Rest API using client\_id admin-cli

**URL:** <https://forum.keycloak.org/t/client-credentials-grant-rest-api-using-client-id-admin-cli/5617>\
**Category:** Getting advice\
**Created:** [October 27, 2020, 2:25pm UTC](https://forum.keycloak.org/t/client-credentials-grant-rest-api-using-client-id-admin-cli/5617 "2020-10-27T14:25:32Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![desijb](https://avatars.discourse-cdn.com/v4/letter/d/f08c70/32.png) [@desijb](https://forum.keycloak.org/u/desijb)\
**Post date:** [October 27, 2020, 2:25pm UTC](https://forum.keycloak.org/t/client-credentials-grant-rest-api-using-client-id-admin-cli/5617/1 "2020-10-27T14:25:32Z")

</div>

Hi,

I am trying to call the REST api with the client\_id admin-cli.

## Password Grant

When the client is set to ‘public’, I can get a token and get all users from a specific realm;

export TOKEN=$(curl --location --request POST ‘server:port/auth/realms/master/protocol/openid-connect/token’   
–header ‘Content-Type: application/x-www-form-urlencoded’   
–data-urlencode ‘username=admin’   
–data-urlencode ‘password=XXXXX’   
–data-urlencode ‘grant\_type=password’   
–data-urlencode ‘client\_id=admin-cli’ | jq -r .access\_token)

curl -H “Content-Type: application/json” -H “Authorization: bearer $TOKEN” -X GET “server:port/auth/admin/realms/MYREALM/users”

-\> works fine. I get the list of users.

## Client Credentials Grant

When the client is set to ‘confidential’ + Service Accounts Enabled: true

export TOKEN=$(curl --location --request POST server:port/auth/realms/master/protocol/openid-connect/token’   
–header ‘Content-Type: application/x-www-form-urlencoded’   
–data-urlencode ‘grant\_type=client\_credentials’   
–data-urlencode ‘client\_id=admin-cli’   
–data-urlencode ‘client\_secret=ffffff1-ffff44aa-ffff-6c2cfb710010’ | jq -r .access\_token)

-\> I get a token, but when i try

curl -H “Content-Type: application/json” -H “Authorization: bearer $TOKEN” -X GET “server:port/auth/admin/realms/MYREALM/users”

I get 403: {“error”:“unknown\_error”}

I must be missing something, any tips?

---

<div class="post-metadata">

**Author:** ![fabiomarcolini](https://avatars.discourse-cdn.com/v4/letter/f/5f8ce5/32.png) [@fabiomarcolini](https://forum.keycloak.org/u/fabiomarcolini)\
**Post date:** [February 11, 2021, 9:54am UTC](https://forum.keycloak.org/t/client-credentials-grant-rest-api-using-client-id-admin-cli/5617/2 "2021-02-11T09:54:01Z")

</div>

I’m in a similar situation I created a new account service with admin role but I always get 403 when trying access resources like GET /admin/realms…

Were you able to find a solution to your problem?

---

<div class="post-metadata">

**Author:** ![sodiumchl](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/sodiumchl/32/2119_2.png) [@sodiumchl](https://forum.keycloak.org/u/sodiumchl)\
**Post date:** [February 20, 2021, 3:12pm UTC](https://forum.keycloak.org/t/client-credentials-grant-rest-api-using-client-id-admin-cli/5617/3 "2021-02-20T15:12:14Z")

</div>

Same issue here. Any explanation?