Keycloak sso with external application

Hi,
we are using keycloak for our application. tech stack spring boot + nextjs + docket.
there is a third-party application we need to establish single sign-on.

use case (flow) is the following: the user is registered in our app (user management is via keycloak) and we need to get access to external app rest endpoints without additional user registration - SSO.

Please suggest how this can be organized via keycloak and what are the best practices.

Thanks
Oleg.