Basically the RFCs apply here Twitch does not really differentiate from the RFC for Token generation here.
But an access token could also be a JSON blob, depends on the service.
Further reading: oauth 2.0 - What characters are allowed in an OAuth2 access token? - Stack Overflow