feathersjs
diff --git a/packages/authentication-client/src/core.ts b/packages/authentication-client/src/core.ts
@@ -114,16 +114,24 @@ export class AuthenticationClient {
   }
 
   /**
-   * Returns the access token from storage or the window location hash.
+   * Returns the access token from the window location hash or storage.
    *
-   * @returns The access token from storage or location hash
+   * @returns The access token from location hash or storage
    */
   getAccessToken(): Promise<string | null> {
-    return this.storage.getItem(this.options.storageKey).then((accessToken: string) => {
-      if (!accessToken && typeof window !== 'undefined' && window.location) {
-        return this.getFromLocation(window.location)
-      }
+    if (typeof window !== 'undefined' && window.location) {
+      return this.getFromLocation(window.location).then((urlToken) => {
+        if (urlToken) {
+          return this.removeAccessToken().then(() => urlToken)
+        }
 
+        return this.storage.getItem(this.options.storageKey).then((storageToken: string) => {
+          return storageToken || null
+        })
+      })
+    }
+
+    return this.storage.getItem(this.options.storageKey).then((accessToken: string) => {
       return accessToken || null
     })
   }

diff --git a/packages/authentication-client/test/index.test.ts b/packages/authentication-client/test/index.test.ts
@@ -96,6 +96,32 @@ describe('@feathersjs/authentication-client', () => {
     }
   })
 
+  it('getAccessToken prefers URL token over storage token (#3631)', async () => {
+    const auth = app.authentication
+    const storageToken = 'old-storage-token'
+    const urlToken = 'new-url-token'
+
+    await auth.setAccessToken(storageToken)
+
+    let stored = await auth.storage.getItem(auth.options.storageKey)
+    assert.strictEqual(stored, storageToken)
+
+    const originalWindow = (global as any).window
+      ; (global as any).window = {
+        location: { hash: `access_token=${urlToken}` }
+      }
+
+    try {
+      const token = await auth.getAccessToken()
+      assert.strictEqual(token, urlToken, 'Should return URL token over storage token')
+
+      stored = await auth.storage.getItem(auth.options.storageKey)
+      assert.strictEqual(stored, undefined, 'Storage should be cleared when URL token is used')
+    } finally {
+      ; (global as any).window = originalWindow
+    }
+  })
+
   it('authenticate, authentication hook, login event', async () => {
     const data = {
       strategy: 'testing'