Refer to the generic URI syntax, it is perfectly valid to have a fragment (The optional part of a URL that starts with an octothorpe #) without a preceding query (The optional part of a URL that starts with a question mark ?).
This is how Stack Exchange returns tokens and other API's have used the same approach. There is nothing wrong with it. In fact, it is as specified in RFC 6749.
The idea was that, by passing the data in the hash, this may make it harder for third-party servers or websites to access. See also OAuth2.0 Implicit Grant flow. Why use url hash fragments?.
Most languages, that you would write an app in, provide shortcuts to get at this fragment -- which usually called the URL hash.
For example, in JavaScript you would use location.hash.
