Refer to [the generic URI syntax][1], it is perfectly valid to have a *fragment* (The optional part of a URL that starts with an octothorpe `#`) without a preceding *query* (The optional part of a URL that starts with a question mark `?`).

This is how Stack Exchange returns tokens and other API's have used the same approach.  There is nothing wrong with it. In fact, **it is as [specified in RFC 6749][2].**

The idea was that, by passing the data in the hash, this may make it harder for third-party servers or websites to access.  See also [OAuth2.0 Implicit Grant flow. Why use url hash fragments?](https://stackoverflow.com/questions/16733863/oauth2-0-implicit-grant-flow-why-use-url-hash-fragments).

----------
Most languages, that you would write an app in, provide shortcuts to get at this fragment -- which usually called the URL *hash*.  
For example, in JavaScript you would use `location.hash`.  



  [1]: https://en.wikipedia.org/wiki/Uniform_Resource_Identifier#Syntax
  [2]: http://tools.ietf.org/html/rfc6749#section-4.2.2