i used keycloak when sighed in ,it is forbidden

do you plan to use Keycloak only for OIDC? or also as your Oauth authorization server?

use keycloak only for OIDC , use the build-in as authorization server