The second flow is to get an extrnal IdM token.

Here are the keycloak docs : http://www.keycloak.org/docs/latest/securing_apps/index.html#external-token-to-internal-token-exchange

Here is a video demo and android sample : https://github.com/secondsun/TokenExchangeDemo/tree/master/app/src/main and https://www.youtube.com/watch?v=FovbEW0VE0E