@evan i saw now, that the client_id is also in the token request and wrapped that too.
now i've:
oauthlib.oauth2.rfc6749.errors.CustomOAuth2Error: (RESTEASY003650: No resource method found for GET, return 405 with Allow header)
"RESTEASY003650" sounds like a keycloak error.
i'm afraid i won't get any further without your support.