Refer to [the generic URI syntax][1], it is perfectly valid to have a *fragment* (The optional part of a URL that starts with an octothorpe `#`) without a preceding *query* (The optional part of a URL that starts with a question mark `?`). This is how Stack Exchange returns tokens and other API's have used the same approach. There is nothing wrong with it. In fact, **it is as [specified in RFC 6749][2].** The idea was that, by passing the data in the hash, this may make it harder for third-party servers or websites to access. See also [OAuth2.0 Implicit Grant flow. Why use url hash fragments?](https://stackoverflow.com/questions/16733863/oauth2-0-implicit-grant-flow-why-use-url-hash-fragments). ---------- Most languages, that you would write an app in, provide shortcuts to get at this fragment -- which usually called the URL *hash*. For example, in JavaScript you would use `location.hash`. [1]: https://en.wikipedia.org/wiki/Uniform_Resource_Identifier#Syntax [2]: http://tools.ietf.org/html/rfc6749#section-4.2.2