code: function (done) {
        // the token is random
        if (token.indexOf('.') === -1) {
          AccessToken.get(token, function (err, instance) {
            if (err) {
              return done(err)
            }
  
            if (!instance) {
              return done(new UnauthorizedError({
                realm: 'user',
                error: 'invalid_request',
                error_description: 'Unknown access token',
                statusCode: 401
              }))
            }
  
            done(null, {
              jti: instance.at,
              iss: instance.iss,
              sub: instance.uid,
              aud: instance.cid,
              iat: instance.created,
              exp: instance.created + instance.ei,
              scope: instance.scope
            })
          })
  
        // the token is not random
        } else {
          done()
        }
      }
docs: Fetch from database