How to lock down an API token to only access what our application needs

when i an doing authorization mode with “private key” it’s working but i contact the service without passing the credential of my user and so the right that he have (ou don’t have)

I am also trying with bearer token that i generated myselft. The Service App has the right bebause with private key mode i get some result with the function “ListUsers”.

But i think i am missing somehting whe i create the TOKEN jtw with private key

this is how i generate my token :

when i do this
image
ListUsers is empty.

I don’t this i pass my current user ( witch is me and is super admin) in my token but i don’t know how