Because that is how the access token is passed to the application in implicit grant flow, and the site does not remove it from the URL itself. window.location.hash lets you access the hash part of the URL in javascript.
1 Like