The question is not completely clear. You may need to post an [MCVE][1]. **Update:** Apparently according to the [OAuth 2.0 Authorization spec (RFC 6749), section 5.1][2]: > The parameters are included in the entity-body of the HTTP response using the "application/json" media type as defined by [RFC4627] So, apparently the `content-type` should be `application/json;charset=UTF-8`.?. That would seem to make sense. Also note that [officially][3]: > Restrictions on usage : This type (x-www-form-urlencoded) is only intended to be used to describe HTML **form submission** payloads. <sup>(Emphasis added)</sup> That is, `x-www-form-urlencoded` is only for submissions to the server, not responses to the client. ---------- ---------- Your app code (and the API) appears to be working properly, you are getting an `access_token` in the body. And yes, the body is `text/plain` (transmitted via SSL). That is how it should be. The purpose of `x-www-form-urlencoded` is to package data in an unambiguous way that removes conflicts with the HTTP protocols (reserved characters, etc.). It is separate but: related to, more compact than, more strict than, and more specialized than HTML -- which is what the server uses to send back the response. Since a server's response to a form POST is expected to be valid HTML, there is no need for form or URL encoding. You can think of x-www-form-urlencoded as a kind of "micro format". [1]: https://stackoverflow.com/help/mcve [2]: https://tools.ietf.org/html/rfc6749#section-5.1 [3]: https://www.iana.org/assignments/media-types/application/x-www-form-urlencoded