Refer to [the generic URI syntax][1], it is perfectly valid to have a *fragment* (The optional part of a URL that starts with an octothorpe `#`) without a preceding *query* (The optional part of a URL that starts with a question mark `?`).

This is how Stack Exchange returns tokens and other API's have used the same approach.  There is nothing wrong with it.

Most languages, that you would write an app in, provide shortcuts to get at this fragment -- which usually called the URL *hash*.  
For example, in JavaScript you would use `location.hash`.


  [1]: https://en.wikipedia.org/wiki/Uniform_Resource_Identifier#Syntax