title: Can my oauth2 callback page be the same html page? and how do I get the token?
body: <p>First off, I'm using static html and javascript and C# Web API.
  So I have a link that calls an oauth2 server, on my html file, say index.html
  Now is it ok to set the callback page to index.html</p>
  
  <p>It seems to work, and it gets sent to index.html?code=125f0...</p>
  
  <p>Is this ok to do or do I need a seperate callback page.  Is code, the token?</p>
  
  <p>Now how should I consume this?The javascript doesn't seem to get hit on the call back.
  Edit, actually, the javascript seems to get hit on the call, back but I'm not getting anything undefined from:</p>
  
  <pre><code>    $(function () {
          var params = {},
              queryString = location.hash.substring(1),
              regex = /(^&amp;=]+)=([^&amp;*])/g,
              m;
          while (m = regex.exec(queryString)) {
              params[decodeURIComponent(m[1])] = decodeURIComponent(m[2]);
          }
          if (params.error) {
              if (params.error == "access_denied") {
                  sAccessToken = "access_denied";
                  //alert(sAccessToken);
              }
          } else {
              sAccessToken = params.code;
              alert(sAccessToken);
          }
      });
  </code></pre>
  
  <p>Also, can my callback page be a C# web api call? And send the token that way. I'm guessing no, cus then you'd never know what user agent is sending it, and couldn't communicate back unless you somehow passed a id and used signalR? It seems better to get it in javascript and send the token to web api.  But then can web api make calls to the resource if it has the token?</p>
  
  <p>sorry, I'm still learning</p>