title: Which flow for securing a data-only microservice with Openid
body: <p>There are three parties in my application:</p>
  
  <ul>
  <li>A web client W (written in Angular)</li>
  <li>Microserice A ("my" microservice, developed in C++)</li>
  <li>Microservice B (developed by a 3rd party but using SSO, trusted microservice)</li>
  </ul>
  
  <p>General communication between those three: The web client W could be either a frontend UI or a mobile device using just the API as a service without having any sort of frontend. W connects to microservice A to manipulate and consume data from it. Microservice A exchanges data with microservice B and vice versa. W does not need to know about B. </p>
  
  <p>I've settled on an architecture for the web client using Openid Authorization Code Flow with PKCE enabled to get and refresh it's token from Keycloak. I've posted a related question here [1].</p>
  
  <p>Now consider this Web Application W is consuming some data from my microservice A. The JWT token from the web client is sent to the microservice as Bearer Authorization. </p>
  
  <p>So far so good. What kind of flow should I use for the microservice itself, in order to enable the service to fetch and eventually refresh tokens for its own use for verification and user info requests? I've read quite a lot, but at almost every place there is a client at play in the workflow. </p>
  
  <p>Can the PKCE Auth Code flow be used for microservices (e.g. instead of logging in let the server send credentials in exchange for a short-lived token)? Or should the microservice simply fetch tokens via secret in confidential mode?</p>
  
  <p>Since I'm implementing the microservice in C++ it basically means there is a lack of libraries. Thus would be good if you detail the flow, since I have to implement it.</p>
  
  <p>[1] <a href="https://stackoverflow.com/questions/60160447/openid-redirect-vs-bearer">OpenID redirect vs bearer</a></p>