Leaking a Google OAuth 2.0 Access Token Through Misconfigured Error Handling

I was hacking on a mobile app and after having proxied traffic from my phone to Burp Suite, I didn't find anything that piqued my interest or seemed vulnerable, all the API endpoints appeared secure.