Implement the Brightspace Valence OAuth 2.0 Authorization Code grant with refresh tokens for a user-facing application

Steps

1. In Manage Extensibility, register an OAuth 2.0 app choosing the Authorization grant workflow, supply a valid Redirect URI, list the scopes you need, and optionally enable "Prompt for user consent" and "Enable refresh tokens".
2. Direct the user's browser to the authorization endpoint https://auth.brightspace.com/oauth2/auth with your Client ID, redirect_uri, and requested scope to start the Authorization Code Grant flow per RFC 6749.
3. After the user authenticates and consents, Brightspace redirects to your Redirect URI with an authorization code; exchange it at https://auth.brightspace.com/core/connect/token using your Client ID and Client Secret for an access token (and, if enabled, a refresh token).
4. Send the access token as `Authorization: Bearer <token>` on API calls; when it expires, use the Refresh workflow to exchange the single-use refresh token for a new access/refresh token pair without re-prompting the user.
5. To revoke access, have the user remove the app from My Settings > Account Settings > Manage Applications, or delete and re-register the app in Manage Extensibility to rotate compromised credentials.