How to protect REST APIs using OAuth resource parameter or bearer-only clients?

can't understand your english, mind using your natvie lang and translate it with chatgpt?

sorry, for programming things I translate with AI

Sorry for the previous messages; I didn't check the translation before sending them and just sent them, as I was used to it being accurate.

I came across Casdoor/Casbin a few days ago and wanted to test it today. The architecture I work with is quite simple: a client and a server, with the client using Next.js (with a clientId and clientSecret) and the server being a REST API with Spring Boot—nothing out of the ordinary.

My question arises because, with other providers I've used to protect APIs (or bearer-only clients), they either adopt the OAuth RFC to refer to these as protected resources (requiring a "resource" parameter when issuing a token to indicate which resource is being referenced) or make non-standard implementations that accept parameters like "audience" or similar.

In the case of Casdoor, the only thing I found was a page in the documentation that references this as one of the steps in the process, but I haven't been able to figure out how to implement it. Using the documentation's search function and entering keywords hasn't led me to anything, and the demo UI doesn't show anything similar to a place where these "API resources" can be registered to then request tokens with these audiences/permissions.

you may first need Casbin's RESTful model: https://casbin.org/docs/supported-models

learn casbin first, then take a look (or not) at casdoor