Level 15
IMO. For registration - the user object will do. (It might include the access token in some instances). the access token is optional because the registration use case is not logging the user into the account.
For login API call - its ideal to return the access token at the very minimum because this will be required to validate subsequent requests after login is successful.
1 like