Not sure I follow entirely, but you're right on the larger perspective:  it is up to the application to present a dialog and, upon the user submitting the form, the application needs to parse out what was approved based on however they do form parameters.  All of this should be delegated to the application, and handled by the parse function.  If stuff is in `info`, that's totally cool, so long as OAuth2orize makes no such assumptions.  The assumption that `info` contains the response is fine in your case, but not generically.  So, you're app should supply that in the parse function (and other people's apps can use info how they see fit)