code: def _request_token(self, env):
          
          params = {}
  
          content = env['wsgi.input'].read(int(env['CONTENT_LENGTH']))
          post_params = parse_qs(content)
          # Convert to dict for easier access
          for param, value in post_params.items():
              decoded_param = param.decode('utf-8')
              decoded_value = value[0].decode('utf-8')
              if decoded_param == "username" or decoded_param == "password":
                  params[decoded_param] = decoded_value
  
          params["grant_type"] = "password"
          params["client_id"] = self.client_id
          params["client_secret"] = self.client_secret
          # Request an access token by POSTing a request to the auth server.
          try:
              response = urllib2.urlopen(self.token_endpoint, urlencode(params))
          except HTTPError, he:
              if he.code == 400:
                  error_body = json.loads(he.read())
                  body = self.SERVER_ERROR_TEMPLATE\
                      .format(error_type=error_body["error"],
                              error_description=error_body["error_description"])
                  return "400 Bad Request", body, {"Content-Type": "text/html"}
              if he.code == 401:
                  return "302 Found", "", {"Location": "/login?failed=1"}
  
          self.token = json.load(response)
  
          return "301 Moved", "", {"Location": "/"}
docs: Retrieves a new access token from the OAuth2 server.