code: def _set_bearer_user_vars(allowed_client_ids, scopes):
    
    all_scopes, sufficient_scopes = _process_scopes(scopes)
    try:
      authorized_scopes = oauth.get_authorized_scopes(sorted(all_scopes))
    except oauth.Error:
      _logger.debug('Unable to get authorized scopes.', exc_info=True)
      return
    if not _are_scopes_sufficient(authorized_scopes, sufficient_scopes):
      _logger.warning('Authorized scopes did not satisfy scope requirements.')
      return
    client_id = oauth.get_client_id(authorized_scopes)
  
    # The client ID must be in allowed_client_ids.  If allowed_client_ids is
    # empty, don't allow any client ID.  If allowed_client_ids is set to
    # SKIP_CLIENT_ID_CHECK, all client IDs will be allowed.
    if (list(allowed_client_ids) != SKIP_CLIENT_ID_CHECK and
        client_id not in allowed_client_ids):
      _logger.warning('Client ID is not allowed: %s', client_id)
      return
  
    os.environ[_ENV_USE_OAUTH_SCOPE] = ' '.join(authorized_scopes)
    _logger.debug('get_current_user() will return user from matched oauth_user.')
docs: Validate the oauth bearer token and set endpoints auth user variables.
  
    If the bearer token is valid, this sets ENDPOINTS_USE_OAUTH_SCOPE.  This
    provides enough information that our endpoints.get_current_user() function
    can get the user.
  
    Args:
      allowed_client_ids: List of client IDs that are acceptable.
      scopes: List of acceptable scopes.