code: @GET
      @Path("create")
      public Response createFromRedirect() {
          KeycloakPrincipal principal = (KeycloakPrincipal) sessionContext.getCallerPrincipal();
          RefreshableKeycloakSecurityContext kcSecurityContext = (RefreshableKeycloakSecurityContext)
                  principal.getKeycloakSecurityContext();
  
          String refreshToken = kcSecurityContext.getRefreshToken();
          Token token = create(refreshToken);
          try {
              String redirectTo = System.getProperty("secretstore.redirectTo");
  
              if (null == redirectTo || redirectTo.isEmpty()) {
                  return Response.ok("Redirect URL was not specified but token was created.").build();
              }
  
              URI location;
              if (redirectTo.toLowerCase().startsWith("http")) {
                  location = new URI(redirectTo);
              } else {
                  URI uri = uriInfo.getAbsolutePath();
                  String newPath = redirectTo.replace("{tokenId}", token.getId().toString());
                  location = new URI(
                          uri.getScheme(),
                          uri.getUserInfo(),
                          uri.getHost(),
                          uri.getPort(),
                          newPath,
                          uri.getQuery(),
                          uri.getFragment()
                  );
              }
  
              return Response.seeOther(location).build();
          } catch (URISyntaxException e) {
              e.printStackTrace();
              return Response.ok("Could not redirect back to the original URL, but token was created.").build();
          }
      }
docs: This endpoint is called when Keycloak redirects the logged in user to our application.
  
  @return a response with a TokenCreateResponse as entity.