OWASP ZAP Keycloak/OIDC/Oauth2 from CLI - keycloak

Question

For my CI, I know need to launch ZAP from the CLI, this works fine:
docker run --net mynetwork -v $(pwd):/zap/wrk/:rw \
-t owasp/zap2docker-stable zap-full-scan.py -I -j -m 10 -T 60 \
-t http://myapiserver.com:8080/api/docs \
-r report-$(date +%Y%m%d-%H%M%S).html
Now, my REST API server uses OAuth2/OIDC/Keycloak, I know how to get a token, no problem with that.
But I can't see how can I activate a community script, AddBearerTokenHeader.js to include a token in each call. The doc is not clear for me and basically demands installing the app to find the keys using the mouse, which I can't (no right to install apps on my PC).
Where can I find what are the parameters to activate this script?
Update
Although I was able to launch the Swing interface from Docker...
docker run -u zap -p 8080:8080 -p 8090:8090 -i owasp/zap2docker-stable zap-webswing.sh
# Browse for http://localhost:8080/zap/
... can't make the config.xml differences raise following the doc (yes, I know how to use docker, share directories, RTFM, etc.).
#SimonBennets' answer provides a nice solution, not the best (what if I want to add multiple headers? how to update tokens?), but it works:
TOKEN=$(curl -ks -X POST \
${URL}realms/${REALM}/protocol/openid-connect/token \
-H "Accept: application/json" \
-H "Content-Type: application/x-www-form-urlencoded" \
-H "cache-control: no-cache" \
-d "grant_type=password" \
-d "username=${USER_NAME}" \
-d "password=${USER_PASS}" \
-d "client_id=admin-cli"|jq -r .access_token|tr -d "\n"
)
docker run --net net_oia \
--name zap \
-v $(pwd):/zap/wrk/:rw \
-e ZAP_AUTH_HEADER="Authorization" \
-e ZAP_AUTH_HEADER_VALUE="Bearer $TOKEN" \
-t owasp/zap2docker-stable zap-full-scan.py -I -j -m 10 -T 60 \
-t http://apidb:8080/api/ \
-r report-$(date +%Y%m%d-%H%M%S).html
My logs showing how the OWASP Zap HEADER is generated (notice the authorization header... why lowercase? anyway, this is ok):
apidb | Headers({'host': 'apidb:8080', 'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0', 'pragma': 'no-cache', 'cache-control': 'no-cache', 'authorization': 'Bearer eyJhbGciOiJSUzI1NiIsIn...'})

Answer 1

An easier option it to use the ZAP_AUTH_HEADER_VALUE env var.
Its explained in more detail here https://www.zaproxy.org/docs/authentication/handling-auth-yourself/