Is it legal to omit the `access_token`?

From section 5.2 of [the IndieAuth spec](https://indieauth.spec.indieweb.org/#authorization-request):
> scope - (optional) A space-separated list of scopes the client is requesting, e.g. "profile", or "profile create". If the client omits this value, the authorization server MUST NOT issue an access token for this authorization code.

From section 5.1 of [RFC6749](https://datatracker.ietf.org/doc/html/rfc6749#section-5.1):
> access_token
> REQUIRED. The access token issued by the authorization server.

The [OAuth2 library](https://github.com/golang/oauth2/blob/3e6480915d39dd1a80fa460e56413857f02cc1b9/internal/token.go#L326) that I'm using will reject responses without an `access_token`, which looks reasonable according to RFC6749.

Is it legal for IndieAuth to require that the token is omitted?

I've worked around this by returning a "dummy" token which doesn't actually grant any access rights. Does this make sense as an alternative?

Read section 5.2 of the IndieAuth specification and RFC 6749 section 5.1, then inspect internal/token.go around line 326 in the linked Go OAuth2 library. Determine whether the specifications conflict and whether the dummy-token workaround is valid. Done means the compatibility question has a documented, agreed resolution.

Written by the indexing model from the issue text.