Keycloak/OAuth2 flow for securing a REST API

Question

I have Keycloak for authentication and authorization of multiple applications (a web page and a REST API). From my understanding the flow for the web page when using OAuth2