It looks like you are sending a malformed access token.  
Your example, `Vy*iWEzkfPKHAzx7PEtJcA%2529%2529` is not of the proper form and exhibits classic URI encoding corruption.

Valid tokens all seem to be 24 characters that end in `))`.  And `)` is often encoded as `%29` by browsers depending on how you get it and/or cut and paste.  
`')' === decodeURIComponent ('%29')`

Additionally, `%25` is the URI encoding of `%`, so your token was *double* URI encoded. (That's two times too many. ;)   )


----------
When I send the same request, with a validly formatted token (which I have since deauthorized):  
          [/2.2/me?access_token=Vza4EEmVimmN4l3O9qZ87Q)) ...][1]  
I get a valid result.

When I double URI-encode the token:  
          [/2.2/me?site=access_token=Vza4EEmVimmN4l3O9qZ87Q%2529%2529 ...][2]  
I get the same 500 error that you got.


----------

----------
Note:  The links above show the proper full format. Obviously, they won't work for you since I deauth'd the token (to protect my account's virginity).  
You can go to [the doc page][3], fetch your own token, and plug it into the above links and it will work.


----------

----------
PS:  At this moment, your base token (`Vy*iWEzkfPKHAzx7PEtJcA))`) appears to still be valid. When I fetch the link:  
          [/2.2/me?site=stackoverflow&access_token=Vy*iWEzkfPKHAzx7PEtJcA))][4]

I get a valid but empty result:

    {"items":[],"has_more":false,"quota_max":10000,"quota_remaining":9998}

which suggests that there might be some security against token hijacking. :)


  [1]: https://api.stackexchange.com/2.2/me?site=stackoverflow&access_token=Vza4EEmVimmN4l3O9qZ87Q))&key=U4DMV*8nvpm3EOpvf69Rxw((
  [2]: https://api.stackexchange.com/2.2/me?site=stackoverflow&access_token=Vza4EEmVimmN4l3O9qZ87Q%2529%2529&key=U4DMV*8nvpm3EOpvf69Rxw((
  [3]: https://api.stackexchange.com/docs/me
  [4]: https://api.stackexchange.com/2.2/me?site=stackoverflow&access_token=Vy*iWEzkfPKHAzx7PEtJcA))&key=YKCpxEolLytlJiKBUCxUJg((