Token view handles exchange/refresh access tokens.

def access_token():
    """Token view handles exchange/refresh access tokens."""
    client = Client.query.filter_by(
        client_id=request.form.get('client_id')
    ).first()

    if not client:
        abort(404)

    if not client.is_confidential and \
            'client_credentials' == request.form.get('grant_type'):
        error = InvalidClientError()
        response = jsonify(dict(error.twotuples))
        response.status_code = error.status_code
        abort(response)

    # Return None or a dictionary. Dictionary will be merged with token
    # returned to the client requesting the access token.
    # Response is in application/json
    return None