An authorized client connects an OAuth2 client registration with the resource owner who authorized it and the access token obtained for that authorization. In a request, Spring retrieves the current authentication, identifies the client registration, and obtains its token. section 8.4
A request-scoped service can use that token when calling a protected API. Request scope matters because Spring populates the SecurityContext during each request, not when application-scoped beans are created. section 8.4
Calling the Taco Cloud API
The taco-admin-client registration is checked on the authenticated request. Its authorized client supplies an access token, which RestIngredientService adds as a Bearer token before requesting ingredients.
