Successful Response.
The OAuth2.0 Authorization Framework - 5.1. Successful Response
The authorization server issues an access token and optional refresh token, and constructs the response by adding the following parameters to the entity-body of the HTTP response with a 200 (OK) status code.

Error Response.
The OAuth2.0 Authorization Framework - 5.2. Error Response
The authorization server responds with an HTTP 400 (Bad Request) status code (unless specified otherwise) and includes the following parameters with the response.
Values for the "error" parameter MUST NOT include characters outside the set %x20-21 / %x23-5B / %x5D-7E.