Access to my "resource"/Application using curl and a bearer token

**Describe your question/**
How to access to my "resource"/Application using a bearer token? In this case, I am just testing with `Curl`

I am unable to access my "resource"/Application using curl with either bearer token nor a "Token" generated from the Admin->Directory->Tokens and App passwords.

The access token I have created are with the `goauthentik.io/api` scope, yet no access to the resource/application that the provider manages.

Tried:

* Access token for a 'Normal user' account (Internal) to a provider 'OAuth2/OpenID Provider'
* Access token for a 'Normal user account to a provider 'Proxy Provider'
* Service account to a provider 'OAuth2/OpenID Provider'
* Service account to a provider 'Proxy Provider'
* Normal user token created from "Tokens and App passwords" to a provider 'OAuth2/OpenID Provider'
* Normal user token created from "Tokens and App passwords" to a provider 'Proxy Provider'

* Also tried with ak_proxy scope (don't know what it means, but it didn't help)

Getting the access token (success):
```
RESPONSE="$(curl -s -X POST \
"https://${AUTH_DOMAIN}/application/o/token/" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=client_credentials" \
-d "client_id=${CLIENT_ID}" \
-d "username=${USERNAME}" \
-d "password=${PASSWORD}" \
-d "scope=${SCOPE}" \
)"
# --data-urlencode "client_secret=${CLIENT_SECRET}" \

ACCESS_TOKEN=$(echo "${RESPONSE}" | jq -r '.access_token // empty')
```

Actually accessing the resource (where it fails):
```
curl -s --location-trusted -L -H "Authorization: Bearer $ACCESS_TOKEN" --location 'https://${TARGET_URL}'
```
Expected response is what my resource should return, but instead I receive the HTML of Authentik's login page:
```

Authentik Authentication

ShadyDOM = { force: !navigator.webdriver };

window.authentik = {
locale: "en-us",
config: JSON.parse('{\u0022error_reporting\u0022: {\u0022enabled\u0022: true, \u0022sentry_dsn\u0022: \u0022https://151ba72610234c4c97c5bcff4e1cffd8@authentik.error\u002Dreporting.a7k.io/4504163677503489\u0022, \u0022environment\u0022: \u0022customer\u0022, \u0022send_pii\u0022: false, \u0022traces_sample_rate\u0022: 0.1}, \u0022capabilities\u0022: [\u0022can_save_media\u0022, \u0022can_asn\u0022, \u0022can_geo_ip\u0022, \u0022can_impersonate\u0022, \u0022is_enterprise\u0022], \u0022cache_timeout\u0022: 300, \u0022cache_timeout_flows\u0022: 300, \u0022cache_timeout_policies\u0022: 300, \u0022cache_timeout_reputation\u0022: 0}'),
brand: JSON.parse('{\u0022matched_domain\u0022: \u0022authentik.somedomain.com\u0022, \u0022branding_title\u0022: \u0022Authentik Authentication\u0022, \u0022branding_logo\u0022: \u0022/media/some\u002Dauth.webp\u0022, \u0022branding_favicon\u0022: \u0022/media/some\u002Dauth\u002Dlogo.png\u0022, \u0022ui_footer_links\u0022: [], \u0022ui_theme\u0022: \u0022automatic\u0022, \u0022flow_authentication\u0022: \u0022default\u002Dauthentication\u002Dflow\u0022, \u0022flow_invalidation\u0022: \u0022default\u002Dinvalidation\u002Dflow\u0022, \u0022flow_user_settings\u0022: \u0022default\u002Duser\u002Dsettings\u002Dflow\u0022, \u0022default_locale\u0022: \u0022\u0022}'),
versionFamily: "2024.12",
versionSubdomain: "version-2024-12",
build: "",
api: {
base: "https://authentik.somedomain.com/",
},
};
window.addEventListener("DOMContentLoaded", function () {

});

window.authentik.flow = {
"layout": "stacked",
};

:root {
--ak-flow-background: url("/static/dist/assets/images/flow_background.jpg");
}

```

No success on any of these. My goal is to access the resources behind 'OAuth2/OpenID' and 'Proxy' Providers.
Accessing these resources using normal Chrome/Edge works by using the 'normal' UI login for both the Normal user and the Service account (I set a password on the service account using the admin panel)

The login flow is just the default standard implicit flow. I ensured that the application/providers have been checked with intercepting headers for login.

**Relevant info**
Tried both Authentik version 2024.12.2 and version 2024.8.3. No success on either

**Screenshots**

**Logs**
Logs for authentik-server-1
```
{"domain_url": null, "event": "/ws/client/", "level": "info", "logger": "authentik.asgi", "pid": 61741, "remote": "192.168.XXX.XXX", "schema_name": "public", "scheme": "ws", "timestamp": "2025-01-11T15:47:14.680616", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0"}
{"action": "login", "auth_via": "oauth_client_secret", "client_ip": "192.168.XXX.XXX", "context": {"application": {"app": "authentik_core", "model_name": "application", "name": "ServiceApplication", "pk": "0b700314632346ff8df791387d5491fa"}, "auth_method": "token", "auth_method_args": {"identifier": "Main-Pass"}, "http_request": {"args": {}, "method": "POST", "path": "/application/o/token/", "request_id": "7c149dd1cf50460c8890b0cbd5587265", "user_agent": "curl/7.88.1"}}, "domain_url": "authentik.somedomain.com", "event": "Created Event", "host": "authentik.somedomain.com", "level": "info", "logger": "authentik.events.models", "pid": 86362, "request_id": "7c149dd1cf50460c8890b0cbd5587265", "schema_name": "public", "timestamp": "2025-01-11T15:47:15.626786", "user": {"email": "some@email.com", "pk": 7, "username": "SomeUsername"}}
{"auth_via": "oauth_client_secret", "domain_url": "authentik.somedomain.com", "event": "Task published", "host": "authentik.somedomain.com", "level": "info", "logger": "authentik.root.celery", "pid": 86362, "request_id": "7c149dd1cf50460c8890b0cbd5587265", "schema_name": "public", "task_id": "7cd4282a829d4a5281eac4909bd24665", "task_name": "authentik.events.tasks.event_notification_handler", "timestamp": "2025-01-11T15:47:15.680003"}
{"auth_via": "oauth_client_secret", "domain_url": "authentik.somedomain.com", "event": "/application/o/token/", "host": "authentik.somedomain.com", "level": "info", "logger": "authentik.asgi", "method": "POST", "pid": 86362, "remote": "192.168.XXX.XXX", "request_id": "7c149dd1cf50460c8890b0cbd5587265", "runtime": 464, "schema_name": "public", "scheme": "https", "status": 200, "timestamp": "2025-01-11T15:47:16.056397", "user": "", "user_agent": "curl/7.88.1"}
{"auth_via": "unauthenticated", "domain_url": "authentik.somedomain.com", "event": "/application/o/authorize/?client_id=5saqQOM3txSSSP4U12sfEJWeCKt0nG8mPPSCwA98&redirect_uri=http%3A%2F%2Flocalhost%3A5222%2Fsignin-authentik&response_type=code&scope=openid%20profile%20email%20goauthentik.io%2Fapi&code_challenge=FSerFga5Yr9QJLN7bEaYMc2d6OaRltw4RC-u2zrR_FY&code_challenge_method=S256&response_mode=form_post&nonce=638722072362445101.YjYzNTkxZDktZmU0YS00N2NjLTgxNWMtMDFkZjY4NmM3ODRjNGUyNzgxZGMtZDk3Ni00NmEwLTg0ZmUtNjY3ODJlZmVlY2My&state=CfDJ8C2Uw9yW7YxOvq_ngl-2jdor7Gndo4ZSpm9Fis9AUCug76vfxYQi8Rwjsd4r5p81BLRR_Tihz_7UdMbn8oFD0x3skTaUmiz2s-H95TULPgb4Z3PSuUZABKRCWhAJ1XpX1pmvjHFf4_WbYnaoEF4tTNw95D3F42NZl8HndS93AvRYB88O2D9T9K3NwiDgACc81gRTAVVLGp7l6Qy0wT_cE_LBsyWL7ndJXVrCeGYxxFzUjEVndIx7hglg_j5nedX8eOO9BTgyad9eezjjxOunyFhbDI0H8ZIqSn29v435eBKMrpCk7bjNBo6zUJm1udXec0JeqQghJXTpSaGQyW6vCYBb3WmU5ryM5mtXBvcB87Au4K7WLE-rGT0_czu9tlFA6LkeOoRdUp40BSzFb5ZgnlwX1BH_21mZYMpi-_FpIq_v&x-client-SKU=ID_NET9_0&x-client-ver=8.0.1.0", "host": "authentik.somedomain.com", "level": "info", "logger": "authentik.asgi", "method": "GET", "pid": 86362, "remote": "192.168.XXX.XXX", "request_id": "81fdd65ff2cd4b35a0a7f600f8a40233", "runtime": 17, "schema_name": "public", "scheme": "https", "status": 302, "timestamp": "2025-01-11T15:47:16.392232", "user": "", "user_agent": "curl/7.88.1"}
{"auth_via": "unauthenticated", "domain_url": "authentik.somedomain.com", "event": "/flows/-/default/authentication/?next=/application/o/authorize/%3Fclient_id%3D5saqQOM3txSSSP4U12sfEJWeCKt0nG8mPPSCwA98%26redirect_uri%3Dhttp%253A%252F%252Flocalhost%253A5222%252Fsignin-authentik%26response_type%3Dcode%26scope%3Dopenid%2520profile%2520email%2520goauthentik.io%252Fapi%26code_challenge%3DFSerFga5Yr9QJLN7bEaYMc2d6OaRltw4RC-u2zrR_FY%26code_challenge_method%3DS256%26response_mode%3Dform_post%26nonce%3D638722072362445101.YjYzNTkxZDktZmU0YS00N2NjLTgxNWMtMDFkZjY4NmM3ODRjNGUyNzgxZGMtZDk3Ni00NmEwLTg0ZmUtNjY3ODJlZmVlY2My%26state%3DCfDJ8C2Uw9yW7YxOvq_ngl-2jdor7Gndo4ZSpm9Fis9AUCug76vfxYQi8Rwjsd4r5p81BLRR_Tihz_7UdMbn8oFD0x3skTaUmiz2s-H95TULPgb4Z3PSuUZABKRCWhAJ1XpX1pmvjHFf4_WbYnaoEF4tTNw95D3F42NZl8HndS93AvRYB88O2D9T9K3NwiDgACc81gRTAVVLGp7l6Qy0wT_cE_LBsyWL7ndJXVrCeGYxxFzUjEVndIx7hglg_j5nedX8eOO9BTgyad9eezjjxOunyFhbDI0H8ZIqSn29v435eBKMrpCk7bjNBo6zUJm1udXec0JeqQghJXTpSaGQyW6vCYBb3WmU5ryM5mtXBvcB87Au4K7WLE-rGT0_czu9tlFA6LkeOoRdUp40BSzFb5ZgnlwX1BH_21mZYMpi-_FpIq_v%26x-client-SKU%3DID_NET9_0%26x-client-ver%3D8.0.1.0", "host": "authentik.somedomain.com", "level": "info", "logger": "authentik.asgi", "method": "GET", "pid": 86362, "remote": "192.168.XXX.XXX", "request_id": "2ae1cf51562f4061a885c4602c6814e0", "runtime": 9, "schema_name": "public", "scheme": "https", "status": 302, "timestamp": "2025-01-11T15:47:16.424197", "user": "", "user_agent": "curl/7.88.1"}
{"auth_via": "unauthenticated", "domain_url": "authentik.somedomain.com", "event": "/if/flow/default-authentication-flow/?next=%2Fapplication%2Fo%2Fauthorize%2F%3Fclient_id%3D5saqQOM3txSSSP4U12sfEJWeCKt0nG8mPPSCwA98%26redirect_uri%3Dhttp%253A%252F%252Flocalhost%253A5222%252Fsignin-authentik%26response_type%3Dcode%26scope%3Dopenid%2520profile%2520email%2520goauthentik.io%252Fapi%26code_challenge%3DFSerFga5Yr9QJLN7bEaYMc2d6OaRltw4RC-u2zrR_FY%26code_challenge_method%3DS256%26response_mode%3Dform_post%26nonce%3D638722072362445101.YjYzNTkxZDktZmU0YS00N2NjLTgxNWMtMDFkZjY4NmM3ODRjNGUyNzgxZGMtZDk3Ni00NmEwLTg0ZmUtNjY3ODJlZmVlY2My%26state%3DCfDJ8C2Uw9yW7YxOvq_ngl-2jdor7Gndo4ZSpm9Fis9AUCug76vfxYQi8Rwjsd4r5p81BLRR_Tihz_7UdMbn8oFD0x3skTaUmiz2s-H95TULPgb4Z3PSuUZABKRCWhAJ1XpX1pmvjHFf4_WbYnaoEF4tTNw95D3F42NZl8HndS93AvRYB88O2D9T9K3NwiDgACc81gRTAVVLGp7l6Qy0wT_cE_LBsyWL7ndJXVrCeGYxxFzUjEVndIx7hglg_j5nedX8eOO9BTgyad9eezjjxOunyFhbDI0H8ZIqSn29v435eBKMrpCk7bjNBo6zUJm1udXec0JeqQghJXTpSaGQyW6vCYBb3WmU5ryM5mtXBvcB87Au4K7WLE-rGT0_czu9tlFA6LkeOoRdUp40BSzFb5ZgnlwX1BH_21mZYMpi-_FpIq_v%26x-client-SKU%3DID_NET9_0%26x-client-ver%3D8.0.1.0", "host": "authentik.somedomain.com", "level": "info", "logger": "authentik.asgi", "method": "GET", "pid": 86362, "remote": "192.168.XXX.XXX", "request_id": "e1e330de4dd44a53add2399d291f0681", "runtime": 15, "schema_name": "public", "scheme": "https", "status": 200, "timestamp": "2025-01-11T15:47:16.460734", "user": "", "user_agent": "curl/7.88.1"}
```
Interestingly, the second log for `oauth_client_secret` shows the user as '' (empty).
However, querying userinfo returns expected result with the access token:
```
# https://authentik.somedomain.com/application/o/userinfo/
{"sub": "8bf215cb689902f83745XXXXXXXXXXXXXXXXXXXXXXXX", "name": "Some Name", "given_name": "Some Name", "preferred_username": "Some Username", "nickname": "Some Username", "groups": ["authentik Admins", "some", "groups"]}```
```

**Version and Deployment (please complete the following information):**

- authentik version: 2024.12.2 (but also tried 2024.8.3)
- Deployment: docker-compose

**Additional Information:**
The oauth2 provider is being accessed directly (testing with localhost/local IP), whereas the proxy provider is being accessed behind haproxy. Both can be access properly from the web browser, so I am sure its nothing related to my proxy.