code: def access_token_handler(self, **args):
          
          message_id = request.args.get('messageId', default=None)
          origin = request.args.get('origin', default='unknown_origin')
          self.logger.info("access_token_handler: origin = " + origin)
          account = request.cookies.get(self.account_cookie_name, default='')
          token = self.access_token(account)
  
          # Build JSON response
          data_str = json.dumps(self.access_token_response(token, message_id))
          ct = "application/json"
  
          # If message_id is set the wrap in HTML with postMessage JavaScript
          # for a browser client
          if (message_id is not None):
              data_str = """<html>
  <body style="margin: 0px;">
  <div>postMessage ACCESS TOKEN %s</div>
  <script>
  window.parent.postMessage(%s, '%s');
  </script>
  </body>
  </html>
  """ % (token, data_str, origin)
              ct = "text/html"
  
          # Send response along with cookie
          response = make_response(data_str, 200, {'Content-Type': ct})
          if (token):
              self.logger.info(
                  "access_token_handler: setting access token = " + token)
              # Set the cookie for the image content
              cookie = self.access_cookie(token)
              self.logger.info(
                  "access_token_handler: setting access cookie = " + cookie)
              response.set_cookie(self.access_cookie_name, cookie)
          else:
              self.logger.info(
                  "access_token_handler: auth failed, sending error")
          response.headers['Access-control-allow-origin'] = '*'
          return response
docs: Get access token based on cookie sent with this request.
  
          This handler deals with two cases:
  
          1) Non-browser client (indicated by no messageId set in request)
          where the response is a simple JSON response.
  
          2) Browser client (indicate by messageId setin request) where
          the request must be made from a an iFrame and the response is
          sent as JSON wrapped in HTML containing a postMessage() script
          that conveys the access token to the viewer.