code: function (req, callback) {
      var params = req.body
      var clientId = params.client_id
      var clientSecret = params.client_secret
  
      // missing credentials
      if (!clientId || !clientSecret) {
        return callback(new AuthorizationError({
          error: 'unauthorized_client',
          error_description: 'Missing client credentials',
          statusCode: 400
        }))
      }
  
      Client.get(clientId, function (err, client) {
        if (err) { return callback(err) }
  
        // Unknown client
        if (!client) {
          return callback(new AuthorizationError({
            error: 'unauthorized_client',
            error_description: 'Unknown client identifier',
            statusCode: 401
          }))
        }
  
        // Mismatching secret
        if (client.client_secret !== clientSecret) {
          return callback(new AuthorizationError({
            error: 'unauthorized_client',
            error_description: 'Mismatching client secret',
            statusCode: 401
          }))
        }
  
        callback(null, client)
      })
    }
docs: HTTP POST body authentication