def _access_token_endpoint(self, req, **kwargs):

        _sdb = self.sdb
        _log_debug = logger.debug

        client_info = self.cdb[str(req["client_id"])]

        assert req["grant_type"] == "authorization_code"

        _access_code = req["code"].replace(' ', '+')
        # assert that the code is valid
        if self.sdb.is_revoked(_access_code):
            return self._error(error="access_denied", descr="Token is revoked")

        # Session might not exist or _access_code malformed
        try:
            _info = _sdb[_access_code]
        except KeyError:
            return self._error(error="access_denied", descr="Token is invalid")

        # If redirect_uri was in the initial authorization request
        # verify that the one given here is the correct one.
        if "redirect_uri" in _info:
            try:
                assert req["redirect_uri"] == _info["redirect_uri"]
            except __HOLE__:
                return self._error(error="access_denied",
                                   descr="redirect_uri mismatch")

        _log_debug("All checks OK")

        issue_refresh = False
        if "issue_refresh" in kwargs:
            issue_refresh = kwargs["issue_refresh"]

        permissions = _info.get('permission', ['offline_access']) or [
            'offline_access']
        if 'offline_access' in _info[
            'scope'] and 'offline_access' in permissions:
            issue_refresh = True

        try:
            _tinfo = _sdb.upgrade_to_token(_access_code,
                                           issue_refresh=issue_refresh)
        except AccessCodeUsed as err:
            logger.error("%s" % err)
            # Should revoke the token issued to this access code
            _sdb.revoke_all_tokens(_access_code)
            return self._error(error="access_denied", descr="%s" % err)

        if "openid" in _info["scope"]:
            userinfo = self.userinfo_in_id_token_claims(_info)
            # _authn_event = _info["authn_event"]
            try:
                _idtoken = self.sign_encrypt_id_token(
                    _info, client_info, req, user_info=userinfo)
            except (JWEException, NoSuitableSigningKeys) as err:
                logger.warning(str(err))
                return self._error(error="access_denied",
                                   descr="Could not sign/encrypt id_token")

            _sdb.update_by_token(_access_code, "id_token", _idtoken)

        # Refresh the _tinfo
        _tinfo = _sdb[_access_code]

        _log_debug("_tinfo: %s" % _tinfo)

        atr = AccessTokenResponse(**by_schema(AccessTokenResponse, **_tinfo))

        logger.info("access_token_response: %s" % atr.to_dict())

        return Response(atr.to_json(), content="application/json")
dataset/ETHPy150Open rohe/pyoidc/src/oic/oic/provider.py/Provider._access_token_endpoint