%% AP1 callback code에서 브라우저 Bearer 요청까지
%% question: AP1에서 authorization code는 어떤 순서로 브라우저의 Bearer API 요청과 사용자 JSON이 되는가?
sequenceDiagram
    participant n0 as 브라우저 SPA
    participant n1 as Keycloak
    participant n2 as Resource Server
    n0->>n1: authorization request · S256 challenge
    n1->>n0: callback · code + state
    n0->>n1: token request · code + verifier
    n1->>n0: access + refresh + ID token
    n0->>n2: GET /api/me · Bearer access token
    n2->>n0: subject · username · issuer · audience