Token

​

Overview

Server-to-server token endpoint. Exchange an authorization code for tokens, or refresh an access token.

Content-Type: application/x-www-form-urlencoded

​

Authorization code grant

Field	Required	Description
grant_type	Yes	authorization_code
code	Yes	Code from the redirect callback
redirect_uri	Yes	Same value as in /authorize
client_id	Yes	OAuth App Key
client_secret	One of	Confidential clients
code_verifier	One of	Public clients, or when PKCE was used on /authorize

On success, the response may include assistant_id and backboard_api_key (see SSO for app modes).

​

Refresh token grant

Field	Required	Description
grant_type	Yes	refresh_token
refresh_token	Yes	Current refresh token
client_id	Yes	OAuth App Key
client_secret	One of	Confidential clients
code_verifier	One of	Public clients

Refresh responses return new access_token and refresh_token only. Do not rely on id_token or backboard_api_key on refresh.

See SSO for examples and sample JSON.