Hmm ... Facebook also doesn't include a token_type, which is hard-required in validate_token_parameters. Raising an exception seems to me to violate the robustness principle:

[C]ode that sends commands or data to other machines (or to other programs on the same machine) should conform completely to the specifications, but code that receives input should accept non-conformant input as long as the meaning is clear.

In Client we default to a token type of Bearer, and we gracefully degrade if token_type is not present in the params passed to _populate_attributes after calling parse_token_response (under which we call validate_token_parameters). I can see raising if there is no access token: the meaning would not be clear in that case. For token_type I think we should raise only if the developer wants strict parsing.

Okay! Ready for review. :-)

cc: @ib-lundgren @idan @singingwolfboy @gulopine

LGTM, but you should document the OAUTHLIB_STRICT_TOKEN_TYPE envvar somewhere.

Looks good :)

Maybe add a comment in http://oauthlib.readthedocs.org/en/latest/oauth2/clients/client.html (change docs as you like btw).

@ib-lundgren It seemed better to add documentation to http://oauthlib.readthedocs.org/en/latest/oauth2/tokens/tokens.html. Look okay to you? :-)

Yay! Thanks @ib-lundgren! :D