IdentityServer4 - ApiResource and Client, how are they tied together

I am trying to determine how ApiResource and Client are tied together.

How do I go about ensuring that someone requesting a token from a Client is requesting it for a particular ApiResource has access to that ApiResource?

Are tried tied together by Scopes?

Here is some slightly modified code from a QuickStart:

public static IEnumerable<ApiResource> GetApiResources()
{
    return new List<ApiResource>
    {
        new ApiResource("api1Resource", "My API")
        {
            Scopes = 
            {
                new Scope("api1"),
                new Scope("api1.ro"),
                new Scope("offline_access")
            },
            UserClaims = { "role", "user" }
        }
    };
}

// client want to access resources (aka scopes)
public static IEnumerable<Client> GetClients()
{
    // client credentials client, for APIs
    return new List<Client>
    {
        new Client
        {
            ClientId = "apiClient",
            AllowedGrantTypes = GrantTypes.ClientCredentials,

            ClientSecrets =
            {
                // Secret that can be created and given to ITSM_API
                new Secret("secret".Sha512(), "ITSM_API Secret")
            },
            AllowedScopes = { "api1", "api1.ro", "offline_access" }
        },

        // resource owner password grant client, for interactive users
        new Client
        {
            ClientId = "userClient",
            AllowedGrantTypes = GrantTypes.List
            (
                GrantType.ResourceOwnerPassword,
                "offline_access"
            ),
            ClientSecrets = 
            {
                new Secret("secret".Sha512(), "userClient Secret")
            },
            UpdateAccessTokenClaimsOnRefresh = true,
            AllowedScopes = { "api1", "api1.ro", "offline_access" },
            AbsoluteRefreshTokenLifetime = 86400,
            AllowOfflineAccess = true,
            RefreshTokenUsage = TokenUsage.ReUse
        }
    };
}