Overview#

If the Authorization Server can accept the Access Token Request values, the Authorization Server sends back an Access Token Response which includes:

• Access Token
• OAuth Scopes - If this attribute is not present, the user denied access to all scopes (yet still clicked "Authorize"). Your application must handle this case gracefully.
• Refresh Token OPTIONALLY
• code_verifier comparing it with the previously associated code_challenge, after first transforming it according to the code_challenge_method method specified by the client.

More Information#

There might be more information for this subject on one of the following:

• OAuth Parameters Registry
• Token_endpoint