title: What characters are allowed in an OAuth2 access token?
body: <p><a href="https://www.rfc-editor.org/rfc/rfc6749" rel="nofollow noreferrer">RFC6749</a> and <a href="https://www.rfc-editor.org/rfc/rfc6750" rel="nofollow noreferrer">RFC6750</a> seem to disagree with one another about what characters are allowed in an OAuth2 Access Token.</p>
  <p><a href="https://www.rfc-editor.org/rfc/rfc6749#appendix-A.12" rel="nofollow noreferrer">Section A.12</a> of RFC6749 (the original OAuth2 spec) defines the access token format as follows:</p>
  <blockquote>
  <p>A.12.  &quot;access_token&quot; Syntax</p>
  </blockquote>
  <blockquote>
  <p>The &quot;access_token&quot; element is defined in Sections 4.2.2 and 5.1:</p>
  </blockquote>
  <blockquote>
  <pre><code>access-token = 1*VSCHAR 
  </code></pre>
  </blockquote>
  <p>In <a href="https://en.wikipedia.org/wiki/Augmented_Backus%E2%80%93Naur_form" rel="nofollow noreferrer">ABNF format</a>, VSCHAR means:</p>
  <blockquote>
  <p>VSCHAR     = %x20-7E</p>
  </blockquote>
  <p>(This is basically <a href="https://stackoverflow.com/questions/983291/purpose-of-x20-x7e-in-regular-expressions">all printable ASCII characters</a>)</p>
  <p>However, in RFC6750 (which deals with the usage of OAuth2 bearer tokens) <a href="https://www.rfc-editor.org/rfc/rfc6750#section-2.1" rel="nofollow noreferrer">Section 2.1</a> seems to set out a stricter subset of allowed characters for access tokens.</p>
  <blockquote>
  <p>The syntax for Bearer credentials is as follows:</p>
  </blockquote>
  <blockquote>
  <pre><code>b64token    = 1*( ALPHA / DIGIT /
  </code></pre>
  </blockquote>
  <pre><code>                   &quot;-&quot; / &quot;.&quot; / &quot;_&quot; / &quot;~&quot; / &quot;+&quot; / &quot;/&quot; ) *&quot;=&quot;
  </code></pre>
  <blockquote>
  <pre><code>credentials = &quot;Bearer&quot; 1*SP b64token
  </code></pre>
  </blockquote>
  <p>So that's a more restrictive set of characters, including only alphanumeric, six special characters, and trailing <code>=</code> for padding.</p>
  <p>My questions are:</p>
  <ol>
  <li><p>Which of these documents is controlling? Does RFC6750 take precedence because it's more restrictive?</p>
  </li>
  <li><p>In terms of actual implementations &quot;in the wild&quot;, are access tokens always limited to the RFC6750 charset?</p>
  </li>
  <li><p>Bonus question: Does anyone know <em>why</em> these two specs published the same month on such closely related topics disagree on the access token format?</p>
  </li>
  </ol>