you requested a token for type token instead of a token of type code
token aka Implicit Auth is for client side apps and will generte and return a access token via location hash
“Normal” oAuth, aka " Authorization code grant" will return a ?code that is to be exchanged for an access token.
Essentially your <a href triggered the wrong token flow
Additionally you should never post generated access tokens publically. Since someone can take it and abuse it or just revoke it. Or in this case acquire your private email address.