[kevlened]

I'm not sure what you mean. The OAuth2 spec defines access tokens and also specifies that they should go in an Authorization header.