sample.js

var sfStrategy = new ForceDotComStrategy({
  clientID: CF_CLIENT_ID,
  clientSecret: CF_CLIENT_SECRET,
  callbackURL: CF_CALLBACK_URL,
  authorizationURL: SF_AUTHORIZE_URL,
  tokenURL: SF_TOKEN_URL
  //the current sample lists the first param as "Token", but it's really an OAuth object  Look at the params field on it.
}, function(oauth, refreshToken, profile, done) { 

  // asynchronous verification, for effect...
  process.nextTick(function() {

    //so if we want to store the oauth info, now is our chance.  
    //instance_url added here since you need that to properly form Force.com API endpoints
    profile.options = {
      Authorization: oauth.params.access_token,
      token_secret: refreshToken,
      instance_url: oauth.params.instance_url
    };


    delete profile._raw;
    return done(null, profile);
  });
});