App OAuth Invalid_token

[Victor]

Hey Guys, I'm trying to convert a SmartThings app to Hubitat.
In SmartThings I can enable OAuth in the App Level and use it to reach out my app and send data to it.
After enable OAuth in Hubitat I was able to access my App using the following:
curl http://192.168.2.201/apps/api/207/alexatv/volumedownby-3 -H "Authorization: Bearer xxxxx-xxxx-xxxx-xxxx"
It worked as expected.

But I'm not able to access my App passing the code in the URL as a parameter like:
curl http://192.168.2.201/apps/api/207/alexatv/volumedownby-3&access_token=xxxxx-xxxx-xxxx-xxxx
I'm always receiving this:
<error_description>xxxxx-xxxx-xxxx-xxxx</error_description>invalid_token

It's very important to pass the access_token in the url because Alexa Dev Portal doesn't allow me to define a header to send it as Authorization Bearer and the token should not expire.

Image for reference:

I have two questions:
1 - Is it possible to access an App using the access_token as a URL parameter?
2- Converting the Expires_In value in the token it looks like it was issued for one year behind:
1577836799 - Tuesday, December 31, 2019 11:59:59 PM. Does it mean an access_token will be valid forever?

For reference:
I followed this link to enable OAuth in my App and generate the access token:
How to Install Custom Apps - Hubitat Documentation
Oauth Flow Cloud and Local - Developers - Hubitat

This is how I did in SmartThings:
Authorization — SmartThings Classic Developer Documentation

[dkilgore90]

Bearer tokens (provided in the header, as you did in your first example) and access_token (provided as a url param) are separate entities in HE. Within your app, you can call createAccessToken(), which creates a url token that can be specified in the url. This is stored in your App's state variables, in case your app code needs to reference it.

[Victor]

@dkilgore90

createAccessToken()

Tks alot for your time.
Worked