code: function (req, callback) {
      var authorization = req.headers.authorization.split(' ')
      var scheme = authorization[0]
      var credentials = Buffer.from(authorization[1], 'base64')
        .toString('ascii')
        .split(':')
      var clientId = credentials[0]
      var clientSecret = credentials[1]
  
      // malformed credentials
      if (credentials.length !== 2) {
        return callback(new AuthorizationError({
          error: 'unauthorized_client',
          error_description: 'Malformed HTTP Basic credentials',
          statusCode: 400
        }))
      }
  
      // invalid authorization scheme
      if (!/^Basic$/i.test(scheme)) {
        return callback(new AuthorizationError({
          error: 'unauthorized_client',
          error_description: 'Invalid authorization scheme',
          statusCode: 400
        }))
      }
  
      // missing credentials
      if (!clientId || !clientSecret) {
        return callback(new AuthorizationError({
          error: 'unauthorized_client',
          error_description: 'Missing client credentials',
          statusCode: 400
        }))
      }
  
      Client.get(clientId, function (err, client) {
        if (err) { return callback(err) }
  
        // Unknown client
        if (!client) {
          return callback(new AuthorizationError({
            error: 'unauthorized_client',
            error_description: 'Unknown client identifier',
            statusCode: 401
          }))
        }
  
        // Mismatching secret
        if (client.client_secret !== clientSecret) {
          return callback(new AuthorizationError({
            error: 'unauthorized_client',
            error_description: 'Mismatching client secret',
            statusCode: 401
          }))
        }
  
        callback(null, client)
      })
    }
docs: HTTP Basic Authentication w/client_id and client_secret