If the user authorizes your application, they will be redirected to the following URL:
https://[your registered redirect URI]/#access_token=[an access token]
&scope=[authorized scopes]
Note that the access token is in the URL fragment and not the query string. This means the value will not show up in HTTP requests to your server. URL fragments can be accessed from JavaScript with document.location.hash
.