Production readiness

Before your integration is promoted to production, three things must be complete:

• An application review
• A signed Partner Agreement
• A completed security assessment

This page sets out what each involves, so you can prepare rather than discover the requirements one at a time. Reading it early is worthwhile — several of these items are easier to build in than to retrofit.

We will ask you to walk us through your application and its integration. Contact us at partners@class.com.au to arrange a session.

Show us the integration working end to end, from a user's perspective.

Provide a diagram showing how your application connects to our APIs, where it runs, and where data is stored.

Confirm the following:

• All interactions and redirects use https.
• Your application uses the state parameter on authorisation requests to mitigate CSRF attacks.
• Your application requests the minimum set of permissions it needs, and no more.
• Your application uses refresh tokens where appropriate, rather than sending users through the authorisation process repeatedly.
• You have supplied the IP addresses your requests will originate from.

Tell us:

• Which endpoints your application will call.
• How many businesses you expect to be connected.
• Expected request volume per day, how requests are initiated (user-triggered, scheduled or batch), and how that volume is distributed across the day.

Your integration must stay within the published rate limits for the product you are integrating with, and must handle throttling responses correctly. Confirm:

• That your expected volume stays within the published limit.
• How your application backs off when it receives an HTTP 429 response.
• If your calls are automated, how they are scheduled or queued to avoid volume spikes.

Rate limits and the response headers that support back-off are documented in each product's resources.

Confirm:

• That your application handles API errors gracefully, including when a user cancels the authorisation process.
• Your retry strategy — in particular, whether a failure within a batch retries the single request or restarts the whole process.

Describe how your application handles tokens:

• Storage — where access tokens are held, and in what form.
• Refresh tokens — how they are stored and managed, and your process for exchanging one for a new access token.
• Protection — what prevents tokens from being exposed or compromised.
• Re-authorisation — what happens when a refresh token expires or is revoked, and how the customer re-authorises your application.

Your Partner Agreement must be signed before production credentials are issued. Your Partnerships contact will manage this alongside the review — it does not need to wait for the review to finish.

You will complete an assessment covering how your organisation and application protect data. Your Partnerships contact facilitates this, and it is reviewed by our IT Security and Cyber teams.

The assessment covers three areas:

Organisation and application — company details, where your application is hosted, data centre locations, third parties involved in delivering your service, and how often you conduct penetration testing.

Certifications — any verifiable certification or independent audit report you hold, such as ISO 27001, SOC 1, SOC 2, SOC 3 or PCI-DSS, or your status as a Digital Service Provider with the ATO.

Controls — key management, encryption in transit and at rest, multi-factor authentication, indirect access to data, vulnerability management, audit logging, hosting location, security monitoring, backups and incident management.

You will receive production credentials and can deploy. If you want support promoting your integration to our client base, speak to your Partnerships contact.

Technical requirements referenced above — rate limits, token lifetimes, error responses — are documented per product:

• HUB24
• Class
• NowInfinity
• myprosperity