Access token is disclosed in sso_authorize request/response.
Make sure the application is running on an unrooted device.