See https://tools.ietf.org/html/rfc5849#section-2.3
"Special:OAuth/token" returns "key" and "secret" fields instead of "oauth_token" and "oauth_token_secret".
Description
Event Timeline
The problem is with SpecialMWOAuth.php#459. @csteipp can you see anything breaking if we set both names? (mwoauth-php depends on the short names for now.)
If you use format=raw, then the output is compliant with rfc5849.
I would discourage updating the json format, since that means all existing consumers would have to be updated.
I see. Maybe you could just add these fields to json output to avoid troubles? I had a really bad time figuring out why my oauth lib is not compatible with MediaWiki :)
If your library is speaking json, then it's already not compatible with the RFC.
If you want to argue that format=raw should be the default to be RFC compatible, I could see putting that out to consumer owners for comment, and see if there's general agreement to change the api in that way. But duplicating the items in json is not something I want to see us do.