You need to define a callback endpoint using the CallbackRoute only for web applications (that is for IndirectClient). The callback endpoint must not be protected.

>> Read the documentation to understand its behavior and the available options.

For example:

CallbackRoute callback = new CallbackRoute(config, null, true);
get("/callback", callback);
post("/callback", callback);

The default internal components of the CallbackRoute are: JEESessionStore.INSTANCE, SparkHttpActionAdapter.INSTANCE, DefaultCallbackLogic.INSTANCE and SparkContextFactory.INSTANCE.