I am new to KeyCloak, but managed to set up the local KeyCloak server. As a client I am using postman to test the authentication part. I am able to get the access token when I enter the OAuth2.0 credentials in postman and able to make a request to access the API.
As the default expire time for the access token is 5 min, when I try again after 5 min to access the API I get Forbidden 403 response from KeyCloak. I expect this should be Unauthorised(401)
If I provide a user credential that doesn't have permission to access the resource then also I get Forbidden 403 response.
How to tell I am getting 403 because of user authorization issue or because of expired access token?
Thanks, Vikas