Absorb Integration API with OAuth 2.0

Updated August 19, 2026 16:36

This article explains how to authenticate with the Absorb Integration API using the OAuth 2.0 authorization code flow. It covers requesting an authorization code, exchanging that code for an access token, and refreshing an access token so your application can maintain access to your LMS data.

For complete endpoint details and additional examples, see our API developer documentation at Absorb API Documentation.

Before You Begin

The OAuth 2.0 flow requires credentials generated in your Portal. Before making any requests, gather the following values, each of which is available in Portal Settings:

Credential	Location
OAuth Client ID	Portal Settings > Info > OAuth Client ID.
OAuth Client Secret	Portal Settings > Info > OAuth Client Secret.
REST API Private Key	Portal Settings > REST API Private Key. Used as the x-api-key header value when requesting a token.

If you are new to the API, see Getting Started with the Absorb Integration API.

For definitions of the terms used throughout this article, see the Integration API Glossary.

Request an Authorization Code

To begin the flow, make a request to the authorization endpoint at https://<portalRoute>/oauth/authorize. The portalRoute is the unique route a user typically takes to visit the LMS. The request uses the following query parameters:

Parameter	Description
client_id	Your unique API client identifier from OAuth Client ID.
client_secret	Your unique API client secret from OAuth Client Secret.
redirect_uri	The URI users are sent back to after authorization. This should always be HTTPS.
response_type	Must be set to "code".
scope	A space-delimited list of the member permissions your application is requesting. Supported scope: "admin.v1".
state	A unique string value of your choice that is hard to guess.

Browser Requirement

Note: Make this request in a web browser rather than in an application such as Postman. Headers are not required to request an authorization code.

The following is an example authorization request. Replace the placeholder values with your own:

https://<portalRoute>/oauth/authorize?client_id=YOUR_CLIENT_ID&client_secret=YOUR_CLIENT_SECRET&redirect_uri=YOUR_REDIRECT_URI&response_type=code&scope=admin.v1&state=YOUR_STATE

The request redirects to the LMS login page. After a successful login, a consent dialog appears. Once the user provides consent, the server redirects to your redirect_uri and returns the authorization code and your state value as query parameters, as shown below:

https://example.com/?code=YOUR_AUTHORIZATION_CODE&state=YOUR_STATE

Note: The authorization code is single-use.

Request an Access Token

Next, exchange the authorization code for an access token by making a request to the token endpoint at https://<portalRoute>/oauth/token. This request requires the following headers:

Header	Description
x-api-version	Must be set to "v1".
x-api-key	Your REST API Private Key from Portal Settings.

Send the request body as x-www-form-urlencoded with the following fields:

Field	Description
grant_type	Must be set to "authorization_code".
client_id	Your OAuth Client ID.
client_secret	Your OAuth Client Secret.
code	The authorization code received in the previous step.
nonce	A string value used to associate a client session with an ID Token and to mitigate replay attacks.
redirect_uri	The URI users are sent back to after authorization. This should always be HTTPS.

A successful request returns a JSON object containing the following fields:

Field	Description
access_token	The access token for your application.
token_type	The type of access token. This is returned as "bearer".
expires_in	The number of seconds remaining until the token expires. In the example response, this value is 14399 seconds, or approximately four hours.
refresh_token	The refresh token, which can be used to acquire new access tokens.

Refresh an Access Token

When an access token expires, use the refresh token to acquire a new one without repeating the full authorization flow. Make this request to the token endpoint at https://<portalRoute>/oauth/token using the same x-api-version and x-api-key headers described above. Send the request body as x-www-form-urlencoded with the following fields:

Field	Description
grant_type	Must be set to "refresh_token".
client_id	Your OAuth Client ID.
client_secret	Your OAuth Client Secret.
refresh_token	The refresh token issued by the server in the previous step.
nonce	A string value used to associate a client session with an ID Token and to mitigate replay attacks.
on-behalf-of	(Optional) The username of another user you would like to be logged in as.
scope	A space-delimited list of the member permissions your application is requesting. Supported scope: "admin.v1".

To retrieve a token on behalf of another user, include the optional on-behalf-of field with that user's username. The response then grants an access token scoped to the specified User.