You need to define a callback endpoint using the CallbackController only for web applications (that is for IndirectClient). The callback endpoint must not be protected.

>> Read the documentation to understand its behavior and the available options.

It is defined in the routes file:

GET    /callback    @org.pac4j.play.CallbackController.callback(request: Request)

And in the SecurityModule:

In Java:

CallbackController callbackController = new CallbackController();
callbackController.setDefaultUrl("/");
bind(CallbackController.class).toInstance(callbackController);

In Scala:

val callbackController = new CallbackController()
callbackController.setDefaultUrl("/")
bind(classOf[CallbackController]).toInstance(callbackController)