Can't create a user in keycloak via api

Question

I'm trying to create user via KeycloakAdminClientService. Client is confidential and has user creation roles associated. not able to create the user, I'm getting forbidden 403 below is the code

UsersResource usersResource = kcProvider.getInstance().realm(realm).users(); CredentialRepresentation credentialRepresentation = createPasswordCredentials(user.getPassword());

    UserRepresentation kcUser = new UserRepresentation();
    kcUser.setUsername(user.getEmail());
    kcUser.setCredentials(Collections.singletonList(credentialRepresentation));
    kcUser.setFirstName(user.getFirstname());
    kcUser.setLastName(user.getLastname());
    kcUser.setEmail(user.getEmail());
    kcUser.setEnabled(true);
    kcUser.setEmailVerified(false);
    usersResource.create(kcUser);

I can fetch the token btw