code: def check_auth(access_token):
      
      if not access_token:
        current_app.logger.error('No access token.')
        return deny('No access token found.')
      request = Request(
        current_app.config['TOKEN_ENDPOINT'],
        headers={"Authorization" : ("Bearer %s" % access_token)}
      )
      contents = urlopen(request).read().decode('utf-8')
      token_data = parse_qs(contents)
      me = token_data['me'][0]
      client_id = token_data['client_id'][0]
      if me is None or client_id is None:
          current_app.logger.error("Invalid token [%s]" % contents)
          return deny('Invalid token')
  
      me, me_error = check_me(me)
      if me is None:
          current_app.logger.error("Invalid `me` value [%s]" % me_error)
          return deny(me_error)
  
      scope = token_data['scope']
      if not isinstance(scope, str):
          scope = scope[0]
      valid_scopes = ('post','create', )
      scope_ = scope.split()
      scope_valid = any((val in scope_) for val in valid_scopes)
  
      if not scope_valid:
          current_app.logger.error("Scope '%s' does not contain 'post' or 'create'." % scope)
          return deny("Scope '%s' does not contain 'post' or 'create'." % scope)
  
      g.user = {
        'me': me,
        'client_id': client_id,
        'scope': scope,
        'access_token': access_token
      }
docs: This function contacts the configured IndieAuth Token Endpoint
      to see if the given token is a valid token and for whom.