tried to add the next procedure in which I take all the necessary info and ask for an auth token from node-oauth2-server npm package. I am now convinced that very good programmers sometimes like to show how smart they are by making their code more complex than it needs to be. This has led me to a decision of building my own auth2 server which will be simplistic and practical. I am pushing the code at this point because this is where i am stuck in the controller oauth2,js authCodeGrant method. If any step fails then you do not get an auth token, so there is no reason to make the execution async or use promises. These guys say to themselves, OH LOOK a call to the database, lets make that async or promise, but you can not move forward until the info has been verified anyway. JavaScript doesnt frustrate me, using other peoples code frustrates me. Also they are requiring a client_secret which is also unecessary according to the RFC at https://tools.ietf.org/html/rfc6749 . The RFC does leave it open to have registrated clients in which the client_secret can be of value.