OAuth Server

​

Overview

​

Use Cases

• Single sign-on across multiple applications
• Third-party integrations that need user identity
• Partner applications that authenticate against your user base
• Mobile apps using OAuth for authentication

​

OAuth 2.0 Flow

1. Third-party app redirects user to Yboard authorization endpoint
2. User logs in or consents
3. Yboard redirects back with an authorization code
4. Third-party app exchanges code for tokens
5. Access token provides user identity

​

Endpoints

​

Authorization Endpoint

GET /api/oauth/authorize
  ?client_id={client_id}
  &redirect_uri={redirect_uri}
  &response_type=code
  &code_challenge={code_challenge}
  &code_challenge_method=S256
  &scope=openid profile email

​

Token Endpoint

POST /api/oauth/token
{
  "grant_type": "authorization_code",
  "code": "{authorization_code}",
  "redirect_uri": "{redirect_uri}",
  "client_id": "{client_id}",
  "code_verifier": "{code_verifier}"
}

​

Refresh Token

POST /api/oauth/token
{
  "grant_type": "refresh_token",
  "refresh_token": "{refresh_token}",
  "client_id": "{client_id}"
}

​

User Profile Endpoint

GET /api/oauth/userinfo
Authorization: Bearer {access_token}

{
  "sub": "user-uuid",
  "email": "user@example.com",
  "name": "John Doe",
  "picture": "https://..."
}

​

Getting Started

1. Go to your Yboard dashboard
2. Navigate to Settings → OAuth Server
3. Create a new OAuth client
4. Configure the redirect URI for your third-party app
5. Use the client ID and secret in your integration

​

Security Considerations

• PKCE required — All flows must use Proof Key for Code Exchange
• Redirect URI validation — Only registered URIs are accepted
• Token expiration — Access tokens expire in 1 hour
• Scope restrictions — Only requested scopes are granted

​

Token Claims

​

Rate Limits