code: function authenticate (req, options) {
    var strategy = this
    var error = req.query && req.query.error
    var code = req.query && req.query.code
  
    options = options || {}
  
    // Handle authorization endpoint error
    if (error && error === 'access_denied') {
      return strategy.fail('Access denied', 403)
    } else if (error) {
      return strategy.error(new AuthorizationError(req.query))
    }
  
    // Handle token response
    if (code) {
      // exchange the code for an access token
      strategy.authorizationCodeGrant(code, function (err, response) {
        if (err) { return strategy.error(err) }
  
        // request user info
        strategy.userInfo(response.access_token, function (err, profile) {
          if (err) { return strategy.error(err) }
  
          // invoke the callback
          strategy.verify(req, response, profile, function (err, user, info) {
            if (err) { return strategy.error(err) }
            if (!user) { return strategy.fail(info) }
            strategy.success(user, info)
          })
        })
      })
  
    // Initiate the OAuth 2.0 Authorization Code Flow
    } else {
      strategy.authorizationRequest(req, options)
    }
  }
docs: Authenticate