1. Backboard SSO
  2. Token
POST
/oauth/token
curl --request POST \
     --url https://app.backboard.io/api/oauth/token \
     --header 'X-API-Key: <api-key>' \
     --header 'Content-Type: application/x-www-form-urlencoded' \
     --data '{
  "grant_type": "authorization_code",
  "code": "string",
  "redirect_uri": "string",
  "client_id": "string",
  "client_secret": "string",
  "code_verifier": "string",
  "refresh_token": "string"
}'

​
Overview

Server-to-server token endpoint. Exchange an authorization code for tokens, or refresh an access token.

Content-Type: application/x-www-form-urlencoded

Call this from your backend only. Never expose client_secret or code_verifier in browser or mobile app code.

​
Authorization code grant

FieldRequiredDescription
grant_typeYesauthorization_code
codeYesCode from the redirect callback
redirect_uriYesSame value as in /authorize
client_idYesOAuth App Key
client_secretOne ofConfidential clients
code_verifierOne ofPublic clients, or when PKCE was used on /authorize

On success, the response may include assistant_id and backboard_api_key (see SSO for app modes).

​
Refresh token grant

FieldRequiredDescription
grant_typeYesrefresh_token
refresh_tokenYesCurrent refresh token
client_idYesOAuth App Key
client_secretOne ofConfidential clients
code_verifierOne ofPublic clients

Refresh responses return new access_token and refresh_token only. Do not rely on id_token or backboard_api_key on refresh.

See SSO for examples and sample JSON.

​
Authorizations

X-API-Key
required
string
API Key authentication

​
Body

application/x-www-form-urlencoded
grant_type
required
string
code
string
redirect_uri
string
client_id
string
client_secret
string
code_verifier
string
refresh_token
string

​
Response

application/json
access_token
required
string
token_type
required
string
expires_in
required
integer
scope
required
string
refresh_token
string
id_token
string
assistant_id
string
backboard_api_key
string
personal_api_key
string
selected_client_name
string