- Backboard SSO
- Token
Backboard SSO
Token
POST
/oauth/token
curl --request POST \
--url https://app.backboard.io/api/oauth/token \
--header 'X-API-Key: <api-key>' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data '{
"grant_type": "authorization_code",
"code": "string",
"redirect_uri": "string",
"client_id": "string",
"client_secret": "string",
"code_verifier": "string",
"refresh_token": "string"
}'
curl --request POST \
--url https://app.backboard.io/api/oauth/token \
--header 'X-API-Key: <api-key>' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data '{
"grant_type": "authorization_code",
"code": "string",
"redirect_uri": "string",
"client_id": "string",
"client_secret": "string",
"code_verifier": "string",
"refresh_token": "string"
}'Overview
Server-to-server token endpoint. Exchange an authorization code for tokens, or refresh an access token.
Content-Type: application/x-www-form-urlencoded
Call this from your backend only. Never expose client_secret or code_verifier in browser or mobile app code.
Authorization code grant
| Field | Required | Description |
|---|---|---|
grant_type | Yes | authorization_code |
code | Yes | Code from the redirect callback |
redirect_uri | Yes | Same value as in /authorize |
client_id | Yes | OAuth App Key |
client_secret | One of | Confidential clients |
code_verifier | One of | Public clients, or when PKCE was used on /authorize |
On success, the response may include assistant_id and backboard_api_key (see SSO for app modes).
Refresh token grant
| Field | Required | Description |
|---|---|---|
grant_type | Yes | refresh_token |
refresh_token | Yes | Current refresh token |
client_id | Yes | OAuth App Key |
client_secret | One of | Confidential clients |
code_verifier | One of | Public clients |
Refresh responses return new access_token and refresh_token only. Do not rely on id_token or backboard_api_key on refresh.
See SSO for examples and sample JSON.
Authorizations
X-API-Key
required
string
API Key authentication
Body
application/x-www-form-urlencoded
grant_type
required
string
code
string
redirect_uri
string
client_id
string
client_secret
string
code_verifier
string
refresh_token
string
Response
application/json
access_token
required
string
token_type
required
string
expires_in
required
integer
scope
required
string
refresh_token
string
id_token
string
assistant_id
string
backboard_api_key
string
personal_api_key
string
selected_client_name
string
curl --request POST \
--url https://app.backboard.io/api/oauth/token \
--header 'X-API-Key: <api-key>' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data '{
"grant_type": "authorization_code",
"code": "string",
"redirect_uri": "string",
"client_id": "string",
"client_secret": "string",
"code_verifier": "string",
"refresh_token": "string"
}'
curl --request POST \
--url https://app.backboard.io/api/oauth/token \
--header 'X-API-Key: <api-key>' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data '{
"grant_type": "authorization_code",
"code": "string",
"redirect_uri": "string",
"client_id": "string",
"client_secret": "string",
"code_verifier": "string",
"refresh_token": "string"
}'