From the documentation found here:
https://github.com/jazzband/django-oauth-toolkit/blob/1.3.2/oauth2_provider/models.py#L172
...
:param request: The HTTP request being processed.
I found that it's not a Django HTTP request, but instead an oauthlib.common.Request. I also learned the method is called twice: one using the caller provided scope, once with a None scope, but that may be related to DOT version 1.1.3.
I verified master and I noticed the same doc. PR coming up.