code: function (done) {
        // the token is a JWT
        if (token.indexOf('.') !== -1) {
          var decoded = AccessTokenJWT.decode(token, options.key)
          if (!decoded || decoded instanceof Error) {
            done(new UnauthorizedError({
              realm: 'user',
              error: 'invalid_token',
              error_description: 'Invalid access token',
              statusCode: 401
            }))
          } else {
            done(null, decoded)
          }
  
        // the token is not a JWT
        } else {
          done()
        }
      }
docs: Handle JWT