diff --git a/apps/gooyal_oauth2/validators.py b/apps/gooyal_oauth2/validators.py
index 697f52d..43c52c2 100755
--- a/apps/gooyal_oauth2/validators.py
+++ b/apps/gooyal_oauth2/validators.py
@@ -16,7 +16,6 @@ log = logging.getLogger("oauth2_provider")
 AccessTokenModel = get_access_token_model()
 UserModel = get_user_model()
 
-USER_MODEL = get_user_model()
 
 
 class OAuth2Validator(BaseOAuth2Validator):  # pylint: disable=w0223
@@ -37,7 +36,7 @@ class OAuth2Validator(BaseOAuth2Validator):  # pylint: disable=w0223
         if not username or not password:
             return False
 
-        user = USER_MODEL.objects.filter(**{user_field: username}).first()
+        user = UserModel.objects.filter(**{user_field: username}).first()
 
         if not user:
             return False
@@ -51,6 +50,19 @@ class OAuth2Validator(BaseOAuth2Validator):  # pylint: disable=w0223
 
         return False
 
+    def _create_user(self, content):
+        content = {'active': True, 'scope': 'ipg.payment:submit accounts.account:retrieve', 'exp': 1602619137,
+                   'client_id': 'bd2hEGXytrqMjbFnplRyHJTeoW1vwKzCZJtH6ro0', 'username': '',
+                   'uuid': '94255117-117c-4a9f-af50-35a6c47503ac', 'email': '', 'phone_number': '+989106853582',
+                   'first_name': '', 'last_name': '', 'name': '', 'balance': 0,
+                   'avatar': 'http://accounts.gooyal.com/media/avatars/1691899.jpg', 'iban': '', 'iban_verified': None}
+
+        # TODO: create user?
+        # user, _created = UserModel.objects.get_or_create(
+        #     **{UserModel.USERNAME_FIELD: content["username"]}
+        # )
+        return None
+
     def _get_token_from_gooyal_authentication_server(
             self, token, introspection_url, introspection_token, introspection_credentials, introspection_client_id,
             introspection_client_secret
@@ -98,30 +110,29 @@ class OAuth2Validator(BaseOAuth2Validator):  # pylint: disable=w0223
                 return None
 
         elif introspection_client_id and introspection_client_secret:
-            client = service_clients.Client(client_id=introspection_client_id,
-                                            client_secret=introspection_client_secret,
-                                            grant_type=service_clients.AccountsClient.GRANT_CLIENT_CREDENTIALS,
-                                            scopes=['introspection'])
+            introspection_client = service_clients.Client(client_id=introspection_client_id,
+                                                          client_secret=introspection_client_secret,
+                                                          grant_type=service_clients.AccountsClient.GRANT_CLIENT_CREDENTIALS,
+                                                          scopes=['introspection'])
             data = {"token": token}
-            response = client.request(url=introspection_url, method='post', data=data,
-                                      required_scopes=['introspection'], login_required=True)
+            response = introspection_client.request(url=introspection_url, method='post', data=data,
+                                                    required_scopes=['introspection'], login_required=True)
 
         try:
-            content = response.json()
+            content: dict = response.json()
         except ValueError:
             log.exception("Introspection: Failed to parse response as json")
             return None
 
+        user = None
         if "active" in content and content["active"] is True:
             if "username" in content:
-                headers = {"Authorization": "Bearer {}".format(token)}
-                user_account = requests.get(f'{settings.BASE_ACCOUNTS_URL}/account', headers=headers).json()
-                user_phone_number = user_account['phone_number']
-                user = UserModel.objects.get(
-                    **{'phone_number': user_phone_number}
-                )
-            else:
-                user = None
+                user_client = service_clients.Client(access_token=token,
+                                                     scopes=content.get('scope','').split(),
+                                                     expires_in=100)
+                user_account = user_client.accounts.account()
+                content.update(user_account)
+                user = self._create_user(content)
 
             max_caching_time = datetime.now() + timedelta(
                 seconds=oauth2_settings.RESOURCE_SERVER_TOKEN_CACHING_SECONDS