I just wanted to make sure no one stumbling across this topic misunderstood. As the OP had already been answered and your response was about OAuth spec and not explicitly Twitch’s implementation of it so could have left readers with the wrong info.
There are areas of the API where Twitch doesn’t follow the spec, so simply referencing it is not always helpful to the matter at hand.