I do not believe that Apple yet uses the access token bit. OAuth tokens also are not meant to be used for authentication, and require either a separate token (

I do not believe that Apple yet uses the access token bit. OAuth tokens also are not meant to be used for authentication, and require either a separate token (as OpenID Connect did) with appropriate security, or to wedge additional security on top of access tokens as Facebook did with Connect. This is basically because access tokens are meant to be messages about allowed access to the API resources, not messages to the client software about the user.