{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-products/class/apis/actuarial provider/sidebars.yaml","current-catalog-info":"current-catalog-info-/products/class/apis/actuarial-provider/actuarial-certificate"},"props":{"metadata":{"markdoc":{"tagList":["admonition"]},"type":"markdown"},"seo":{"title":"Actuarial Certificate — Authentication","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"actuarial-certificate--authentication","__idx":0},"children":["Actuarial Certificate — Authentication"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The Actuarial Certificate callback endpoints are protected by OAuth 2.0 using the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Resource Owner Password Flow"]}," with Bearer tokens."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Every request your system makes to a Class callback endpoint must include a valid bearer token in the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Authorization"]}," header. The token must belong to the provider login account Class set up for you, which carries a special role required to call these endpoints."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["There are two authentication directions in this integration:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Provider → Class"]}," (covered here) — always OAuth password grant, described below."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Class → Provider"]}," (the initial request) — agreed per provider during onboarding; see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/class/apis/actuarial-provider/registration"},"children":["Registration"]},"."]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"credentials-you-need","__idx":1},"children":["Credentials you need"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Credential"},"children":["Credential"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Where it comes from"},"children":["Where it comes from"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client ID"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Provided by Class during registration. Different per environment."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Client Secret"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Provided by Class during registration. Different per environment."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Provider login (username)"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The Class user account set up for your integration during registration."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Provider login password"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The password for that account."]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"requesting-a-token","__idx":2},"children":["Requesting a token"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Make a POST to the token endpoint. Note the token endpoint is on the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["app"]}," host, not the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["apigateway"]}," host."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Environment"},"children":["Environment"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Token URL"},"children":["Token URL"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["PIE (Sandbox)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://app.class-pie.com.au/connect/token"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Production"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://app.class.com.au/connect/token"]}]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Example request"]}," — ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Content-Type: application/x-www-form-urlencoded"]},":"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"POST /connect/token HTTP/1.1\nHost: app.class-pie.com.au\nContent-Type: application/x-www-form-urlencoded\n\ngrant_type=password\n&client_id=your-client-id\n&client_secret=your-client-secret\n&username=your-provider-login\n&password=your-provider-login-password\n"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Example response:"]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n    \"access_token\": \"eyJhbGciOiJSUzI1NiIsInR5cCI6...\",\n    \"expires_in\": 900,\n    \"token_type\": \"Bearer\",\n    \"scope\": \"fund.read\"\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"using-the-token","__idx":3},"children":["Using the token"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Attach the token as a Bearer token in the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Authorization"]}," header of every callback request:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"POST /api/1.0/c/service-provider/{providerId}/actuary/certificate-request/{requestId}/status HTTP/1.1\nHost: apigateway.class-pie.com.au\nAuthorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6...\nContent-Type: application/json\n\n{ ... }\n"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"scope","__idx":4},"children":["Scope"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The certificate endpoints require the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["fund.read"]}]}," scope. Although creating and updating a status are write operations, access is granted through the provider login's role rather than a maintain scope, so ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["fund.read"]}," is sufficient."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"token-lifespan","__idx":5},"children":["Token lifespan"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Access tokens are valid for ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["15 minutes"]}," (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["expires_in: 900"]},")."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["After expiry, request a new token using the same password flow."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Refresh tokens are ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["not"]}," issued for this flow."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"reference","__idx":6},"children":["Reference"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/class/resources/resource-owner-password-flow"},"children":["Resource Owner Password Flow"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"http://tools.ietf.org/html/rfc6750"},"children":["RFC 6750 — Bearer Token Usage"]}]}]}]},"headings":[{"value":"Actuarial Certificate — Authentication","id":"actuarial-certificate--authentication","depth":2},{"value":"Credentials you need","id":"credentials-you-need","depth":3},{"value":"Requesting a token","id":"requesting-a-token","depth":3},{"value":"Using the token","id":"using-the-token","depth":3},{"value":"Scope","id":"scope","depth":3},{"value":"Token lifespan","id":"token-lifespan","depth":3},{"value":"Reference","id":"reference","depth":3}],"frontmatter":{"seo":{"title":"Actuarial Certificate — Authentication"}},"lastModified":"2026-08-03T06:39:46.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/products/class/apis/actuarial-provider/authentication","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}