Access Token prefixed with # rather than?

Twitch responds with https://<your registered redirect URI>#access_token=<an access token> for the Implicit OAuth flow because that is what the industry standard calls for so Twitch (like every other site using OAuth that sticks to the specifications for the Implicit grant type) responds according to that standard and uses #access_token=.

Alternatively, unless your app specifically needs to use the Implicit flow, it may be beneficial to use the Authorization Code Flow as then Twitch’s response will user a ?code= querystring param, which can be POST’ed to Twitch which responds with access/refresh/expiration/scopes etc… in the response body.

2 Likes