How to use the forge-apis.AuthClientThreeLegged function in forge-apis

// already a version, just return
      callback(autodeskItem);
      return;
    }

    if (autodeskItem.indexOf('/items/') == -1) {
      console.log('Invalid item: ' + autodeskItem);
      return;
    }

    var params = autodeskItem.split('/');
    var itemId = params[params.length - 1];
    var projectId = params[params.length - 3];

    var token = new Credentials(req.session);
    var forge3legged = new forgeSDK.AuthClientThreeLegged(
      config.forge.credentials.client_id,
      config.forge.credentials.client_secret,
      config.forge.callbackURL,
      config.forge.scope,
      true);

    var items = new forgeSDK.ItemsApi();
    items.getItemVersions(projectId, itemId, {}, forge3legged, token.getForgeCredentials())
      .then(function (versions) {
        var moment = require('moment');
        var lastVersionId;
        var newestVersion = moment('2000-01-01');

        versions.body.data.forEach(function (version) {
          var versionDate = moment(version.attributes.lastModifiedTime);
          if (versionDate.isAfter(newestVersion)) {

var params = autodeskFolder.split('/');

    if (autodeskFolder.indexOf('/folders/') > -1) {
      // already a folder, just return
      callback(params[params.length - 3], params[params.length - 1]);
      return;
    }

    // projects have this piece of string... may need to improve this check
    if (autodeskFolder.indexOf('/project/v1/hubs/') == -1) {
      console.log('Invalid folder: ' + autodeskFolder);
      return;
    }

    var token = new Credentials(req.session);
    var forge3legged = new forgeSDK.AuthClientThreeLegged(
      config.forge.credentials.client_id,
      config.forge.credentials.client_secret,
      config.forge.callbackURL,
      config.forge.scope,
      true);

    // get the root folder of this project
    var hubId = params[params.length - 3];
    var projectId = params[params.length - 1];
    var projects = new forgeSDK.ProjectsApi();
    projects.getProject(hubId, projectId, forge3legged, token.getForgeCredentials())
      .then(function (project) {
        var rootFolderId = project.body.data.relationships.rootFolder.data.id;
        callback(projectId, rootFolderId);
      })
      .catch(function (error) {

console.log('got back csrf: ' + csrf);

  if (!csrf || csrf !== req.session.csrf) {
    res.status(401).end();
    return;
  }

  var code = req.query.code;
  if (!code) {
    res.redirect('/');
  }

  var tokenSession = new token(req.session);

  // first get a full scope token for internal use (server-side)
  var req1 = new forgeSDK.AuthClientThreeLegged(config.credentials.client_id, config.credentials.client_secret, config.callbackURL, config.scopeInternal);
  console.log(code);
  req1.getToken(code)
    .then(function (internalCredentials) {

      tokenSession.setInternalCredentials(internalCredentials);
      tokenSession.setInternalOAuth(req1);

      console.log('Internal token (full scope): ' + internalCredentials.access_token); // debug

      // then refresh and get a limited scope token that we can send to the client
      var req2 = new forgeSDK.AuthClientThreeLegged(config.credentials.client_id, config.credentials.client_secret, config.callbackURL, config.scopePublic);
      req2.refreshToken(internalCredentials, config.scopePublic)
        .then(function (publicCredentials) {
          tokenSession.setPublicCredentials(publicCredentials);
          tokenSession.setPublicOAuth(req2);

router.get('/api/forge/callback/oauth', function (req, res) {
  var code = req.query.code;
  var tokenSession = new token(req.session);

  // first get a full scope token for internal use (server-side)
  var req = new forgeSDK.AuthClientThreeLegged(config.credentials.client_id, config.credentials.client_secret, config.callbackURL, config.scopeInternal);
  //console.log(code);
  req.getToken(code)
    .then(function (internalCredentials) {

      tokenSession.setInternalCredentials(internalCredentials);
      tokenSession.setInternalOAuth(req);

      //console.log('Internal token (full scope): ' + internalCredentials.access_token); // debug

      // then refresh and get a limited scope token that we can send to the client
      var req2 = new forgeSDK.AuthClientThreeLegged(config.credentials.client_id, config.credentials.client_secret, config.callbackURL, config.scopePublic);
      req2.refreshToken(internalCredentials)
        .then(function (publicCredentials) {
          tokenSession.setPublicCredentials(publicCredentials);
          tokenSession.setPublicOAuth(req2);

router.get('/api/forge/profile', function (req, res) {
  var token = new Credentials(req.session);
  var credentials = token.getForgeCredentials();
  if (credentials === undefined) {
    res.status(401).end();
    return;
  }

  var forge3legged = new forgeSDK.AuthClientThreeLegged(
    config.forge.credentials.client_id,
    config.forge.credentials.client_secret,
    config.forge.callbackURL,
    config.forge.scope,
    true);

  var user = new forgeSDK.UserProfileApi();
  user.getUserProfile(forge3legged, token.getForgeCredentials())
    .then(function (profile) {
      token.setAutodeskId(profile.body.userId);
      // This feature is not GDPR compliant
      //stats.userProfile(profile.body);
      res.json({
        name: profile.body.firstName + ' ' + profile.body.lastName,
        picture: profile.body.profileImages.sizeX40,
        id: profile.body.userId

router.get('/api/forge/callback/oauth', function (req, res) {
  var token = new Credentials(req.session);

  var code = req.query.code;
  var forge3legged = new forgeSDK.AuthClientThreeLegged(
    config.forge.credentials.client_id,
    config.forge.credentials.client_secret,
    config.forge.callbackURL,
    config.forge.scope);

  forge3legged.getToken(code).then(function (credentials) {
    delete credentials.refresh_token;
    token.setForgeCredentials(credentials);
    res.redirect('/')
  }).catch(function (err) {
    console.log(err);
    res.redirect('/')
  })
});

getClient(scopes = config.scopes.internal) {
        const { client_id, client_secret, callback_url } = config.credentials;
        return new AuthClientThreeLegged(client_id, client_secret, callback_url, scopes);
    }

getClient(scopes = config.scopes.internal) {
        const { client_id, client_secret, callback_url } = config.credentials;
        return new AuthClientThreeLegged(client_id, client_secret, callback_url, scopes);
    }

prepareAutodeskStorage: function (projectId, folderId, fileName, req, callback) {
    var token = new Credentials(req.session);
    var forge3legged = new forgeSDK.AuthClientThreeLegged(
      config.forge.credentials.client_id,
      config.forge.credentials.client_secret,
      config.forge.callbackURL,
      config.forge.scope,
      true);

    var stats = require('./../stats/stats');
    stats.transfer(projectId, 'upload');

    var folders = new forgeSDK.FoldersApi();
    folders.getFolderContents(projectId, folderId, {}, forge3legged, token.getForgeCredentials())
      .then(function (folderData) {
        for (var key in folderData.body.data) {
          item = folderData.body.data[key];
          if (item.attributes.displayName === fileName || item.attributes.displayName === withoutExtension(fileName)) {
            if (req.body.conflict === 'skip') {

createItemOrVersion: function (fileName, projectId, folderId, objectId, credentials, callback) {
    var forge3legged = new forgeSDK.AuthClientThreeLegged(
      config.forge.credentials.client_id,
      config.forge.credentials.client_secret,
      config.forge.callbackURL,
      config.forge.scope,
      true);

    var folders = new forgeSDK.FoldersApi();
    folders.getFolderContents(projectId, folderId, {}, forge3legged, credentials)
      .then(function (folderData) {
        var item = null;
        for (var key in folderData.body.data) {
          item = folderData.body.data[key];
          if (item.attributes.displayName === fileName || item.attributes.displayName === withoutExtension(fileName)) {
            break;
          } else {
            item = null;