All of these are space-separated:

redirect_uri: https://github.com/bshaffer/oauth2-server-php/blob/develop/src/OAuth2/Controller/AuthorizeController.php#L152
grant_types: https://github.com/bshaffer/oauth2-server-php/blob/develop/src/OAuth2/Storage/Pdo.php#L83
scope: https://github.com/bshaffer/oauth2-server-php/blob/develop/src/OAuth2/Scope.php#L48