Step 2: Parsing the access token from the URL

After the user approves access, the pop up window is redirected back to the specified redirect_uri and an access_token is included in the # hash fragment. Here’s an example URL for this application:

http://photoviewer.saasyapp.com/pv/oauth2callback.html#access_token=ya29.AHES6ZSzX&token_type=Bearer&expires_in=3600

JavaScript doesn’t traditionally treat elements of the hash fragment as name/value pairs, so we need to parse out the value of the access_token and other elements of the OAuth response:

var oauthParams = {};

// parse the query string
// from http://oauthssodemo.appspot.com/step/2
var params = {}, queryString = location.hash.substring(1),
    regex = /([^&=]+)=([^&]*)/g, m;
while (m = regex.exec(queryString)) {
  oauthParams[decodeURIComponent(m[1])] = decodeURIComponent(m[2]);
}

...