diff --git a/addons/auth_oauth_provider/controllers/main.py b/addons/auth_oauth_provider/controllers/main.py
index d0ca059aa93..79393a84a43 100644
--- a/addons/auth_oauth_provider/controllers/main.py
+++ b/addons/auth_oauth_provider/controllers/main.py
@@ -30,8 +30,8 @@ class AuthOAuthProvider(openerpweb.Controller):
     _cp_path = '/oauth2'
 
     @openerpweb.jsonrequest
-    def get_token(self, req, **kw):
-        token = req.session.model('res.users').get_oauth_token()
+    def get_token(self, req, client_id="", scope="", **kw):
+        token = req.session.model('res.users').get_oauth_token(client_id, scope)
         return {
             'access_token': token,
         }
diff --git a/addons/auth_oauth_provider/res_users.py b/addons/auth_oauth_provider/res_users.py
index 667ef3f838e..b1bf8270f0b 100644
--- a/addons/auth_oauth_provider/res_users.py
+++ b/addons/auth_oauth_provider/res_users.py
@@ -19,15 +19,20 @@
 #
 ##############################################################################
 from openerp.osv import osv, fields
+import random
+import string
 
 class res_users(osv.osv):
     _inherit = 'res.users'
 
     _columns = {
-        'last_oauth_token': fields.char('Last OAuth Token', size=64, readonly=True, invisible=True),
+        'last_oauth_token': fields.char('Last OAuth Token', readonly=True, invisible=True),
     }
 
-    def get_oauth_token(self, cr, uid, context=None):
-        return "TOKENJEFILWJLK"
+    def get_oauth_token(self, cr, uid, client_id="", scope="", context=None):
+        chars = string.ascii_uppercase + string.ascii_lowercase + string.digits
+        token = ''.join(random.choice(chars) for x in range(random.randrange(16, 24)))
+        self.write(cr, uid, [uid], { "last_oauth_token": token }, context=context)
+        return token
 
 # vim:expandtab:smartindent:tabstop=4:softtabstop=4:shiftwidth=4:
diff --git a/addons/auth_oauth_provider/static/src/js/oauth_provider.js b/addons/auth_oauth_provider/static/src/js/oauth_provider.js
index f2bd4b21c00..2551c82cd2a 100644
--- a/addons/auth_oauth_provider/static/src/js/oauth_provider.js
+++ b/addons/auth_oauth_provider/static/src/js/oauth_provider.js
@@ -16,25 +16,30 @@ instance.auth_oauth_provider.ProviderAction = instance.web.Widget.extend({
         if (!params.redirect_uri) {
             this.error(_t("No 'redirect_uri' parameter given"));
         }
-        // params.client_id TODO
-        // params.scope TODO
         // params.approval_prompt TODO
         if (!this._error) {
-            instance.session.rpc('/oauth2/get_token', {}).then(function(r) {
-                self.redirect(r.access_token);
+            instance.session.rpc('/oauth2/get_token', {
+                client_id: params.client_id || '',
+                scope: params.scope || '',
+            }).then(function(result) {
+                self.redirect(result);
             }).fail(function() {
                 self.error(_t("An error occured while contacting the OpenERP server."));
             });
         }
     },
-    redirect: function(access_token) {
+    redirect: function(result) {
         var params = $.deparam($.param.querystring());
         var a = document.createElement('a');
         a.href = params.redirect_uri;
-        var search = (a.search ? '&' : '?') + 'access_token=' + access_token;
+        var search = (a.search ? '&' : '?') + 'access_token=' + result.access_token;
         if (params.state) {
             search += "&state=" + params.state;
         }
+        if (params.expires_in) {
+            search += "&expires_in=" + expires_in;
+        }
+        search += '&token_type=Bearer';
         var redirect = a.protocol + '//' + a.host + a.pathname + search + a.hash;
         //window.location = redirect;
         console.log("redirect to", redirect);