A kind of basic token endpoint as an express router (won't actually work for you without some tweaks)

token-endpoint.js

const express = require('express');
const cors = require('cors');
const bodyParser = require('body-parser');
const request = require('request');
const jwt = require('jsonwebtoken');
const qs = require('querystring');
const config = require('../config');

const router = express.Router({
  caseSensitive: true,
  mergeParams: true,
});

router.use(bodyParser.urlencoded({ extended: true }));
router.use(bodyParser.json());
router.use(cors());
router.options(cors());

const normalizeUrl = url => {
  url = url.trim();
  url = url.toLowerCase();
  url = url.replace(/\/+$/, '');
  return url;
};

router.post('/', (req, res, next) => {
  if (
    req.body.code &&
    req.body.me &&
    req.body.redirect_uri &&
    req.body.client_id
  ) {
    if (normalizeUrl(req.body.me) != normalizeUrl(config.get('me'))) {
      return next(new Error('me was not ' + config.get('me')));
    }
    request.post(
      {
        url: 'https://indieauth.com/auth',
        headers: {
          Accept: 'application/json',
        },
        form: {
          code: req.body.code,
          me: normalizeUrl(req.body.me),
          redirect_uri: req.body.redirect_uri,
          client_id: req.body.client_id,
        },
      },
      (err, httpResponse, body) => {
        body = JSON.parse(body);
        if (
          err ||
          !body ||
          !body.me ||
          normalizeUrl(body.me) != normalizeUrl(config.get('me')) ||
          body.error
        ) {
          console.log(err || body.error || 'Me does not match');
          return res.sendStatus(400);
        }
        const tokenData = {
          me: normalizeUrl(body.me),
          client_id: req.body.client_id,
          scope: body.scope,
          date_issued: new Date(),
        };
        const access_token = jwt.sign(tokenData, config.get('jwtSecret'), {
          expiresIn: 60 * 60 * 24 * 365,
        });
        const response = {
          me: normalizeUrl(body.me),
          scope: body.scope,
          access_token: access_token,
        };
        if (
          req.headers.accept &&
          req.headers.accept.indexOf('application/json') > -1
        ) {
          res.json(response);
        } else {
          res.header('Content-Type', 'application/x-www-form-urlencoded');
          res.send(qs.stringify(response));
        }
      },
    );
  } else {
    return res.sendStatus(400);
  }
});

router.get('/', (req, res, next) => {
  if (req.headers.authorization) {
    const token = req.headers.authorization.replace('Bearer ', '');
    jwt.verify(token, config.get('jwtSecret'), (err, tokenData) => {
      if (err) {
        console.log(err);
        return res.sendStatus(401);
      }
      if (normalizeUrl(tokenData.me) == normalizeUrl(config.get('me'))) {
        // All good :)
        const response = {
          me: normalizeUrl(tokenData.me),
          client_id: tokenData.client_id,
          scope: tokenData.scope,
        };
        if (
          req.headers.accept &&
          req.headers.accept.indexOf('application/json') > -1
        ) {
          res.json(response);
        } else {
          res.header('Content-Type', 'application/x-www-form-urlencoded');
          res.send(qs.stringify(response));
        }
      }
    });
  }
});

module.exports = router;