Using service account to read and update data in keycloak best practice

Question

Inherited code from a team mate around keycloak IAM. My gut tells me we are not using it properly. From looking at the code, for any kind of operations, e.g. getting a user's details, they make use of the keycloak service account. They will 'log into' the service account using keycloak's REST APIs (username and password stored in our backend auth service's .env file). Once they have the bearer key, they will use that to make multiple requests like getting the user's details, resetting a password, etc.

Is this best practice? I would have imagined rather than having a service account, keycloak would have the idea of authorised applications/identities and we would instead have some kind of key/token which is handed out to each application which wants to talk to keycloak directly.

Thanks