You can check the same in the browser's network tab under "Response Headers" (provided you have set the response header from your server end) :

It depends on the application.

The authorization endpoint usually responses with the tokens in a response body (JSON).

The frontend application parses that body and stores tokens in LocalStorage or CookieStorage. For single page apps, tokens can be stored in the app's memory (variables).

Access tokens are being read by the frontend app from that storage, and they're being put into Headers of WebServices API calls.