[keycloak-user] Modify roles in Token after user login SPI

Hi Community, I'm trying to add more roles into the token after the token has been generated following the isValid() return of the Authentication SPI. I have a application which has SMS otp functionality. After the user has verified the OTP I want to grant more roles to the user by adding those roles into the token. But how do I modify the existing token or even renew it with new roles ? Is there a endpoint I can use to do so ? Or anyother ProviderInterface that I can use to achieve this ? Regards