In that code, you're defining a verify function. That verify function will be passed (from whatever code calls it--you don't need to know where) a username, a password, and a callback function that should be called when the verify function is done with its work. You don't need to know what the callback function will do, only that you must call it with the results of the verification.