The list of of “keys” does include access codes, passwords, or other credentials which would be representative of OAuth tokens.
The phrasing can be a little hard to parse as it is it is a legal document, so if you’re unsure about anything you should consult a expert as none of us here on the forums can give definitive legal advice on how to interpret it.