OAuth API for Mobile - How to accomplish? Whitelist?

If it says “?code=” then that is not the final token (authorization code flow). If it says “#access_token=” then that is the final token (implicit flow).