Presumably, a confidential client identifies itself to the AS to exchange a code for an access token, so you know at that point that the access token was meant

Presumably, a confidential client identifies itself to the AS to exchange a code for an access token, so you know at that point that the access token was meant for that particular client. That said, Facebook Connect is an under-documented vendor extension to OAuth, and only is supported for use via the official SDKs. They do now have a bit more alignment with OpenID Connect and PKCE as an option, but I imagine most existing parties do not use it. https://developers.facebook.com/docs/facebook-login/guides/advanced/manual-flow https://developers.facebook.com/docs/facebook-login/guides/a...