Depends on the flow. For the authorization flow, this happens when apps make the token request to accounts.cnx.org/oauth/token (after they receive the code).