3 ms·

I believe they're both in the query string, but you're right - code is what's sent by way of the client. access_token is exchanged between the servers.