{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-products/class/resources/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition"]},"type":"markdown"},"seo":{"title":"OAuth 2.0 Authorisation Code Flow – Class API","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"oauth-20-authorisation-code-flow--class-api","__idx":0},"children":["OAuth 2.0 Authorisation Code Flow – Class API"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In this article, we will provide a detailed description of why to use this flow, how to obtain access tokens, refresh tokens and id tokens via the OAuth 2.0 Authorisation Code Flow."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Authorisation code flow is the preferred flow and most secure method of accessing the Class API. This flow allows for communication from secure servers only (https) and requires customers to provide authentication that includes MFA, making it very secure and complies with the ATO requirements."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This flow also allows the issue of refresh tokens making it possible for web applications to obtain information without having the end user authenticate again, each time."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["To use this flow, you will be required to provide a redirect URL and an image/logo to identify your Application to end users that authorise your Application to obtain data from Class on their behalf. End-users will be able to also revoke permission from your Application if required (cancel refresh tokens)."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Note:"]}," You can provide us your redirect URL by emailing ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"mailto:partners@class.com.au"},"children":["partners@class.com.au"]},"."]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"img","attributes":{"src":"/assets/oauth_code-flow.9bc77203de992916921bb7eedf5a576b98fd923c7e558272fef356df59e18a0b.9c1bb791.jpg","alt":"Authorisation Code Flow diagram."},"children":[]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"flow-overview","__idx":1},"children":["Flow Overview"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The authorisation code flow is designed for integrations that can keep the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_secret"]}," confidential (e.g., web server apps). It supports refresh tokens and involves:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Your integration directs the user to the Class authorisation endpoint by making an ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["authorisation request"]},". This request identifies your Application and the scope of resources you wish to access."]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"https://apigateway.class.com.au/connect/authorize\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Once authorisation is complete, Class redirects the user to the requested ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["redirection endpoint"]}," of your Application. An authorization code is included in the response."]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"https://{yourApp}.{yourDomain}.com.au/class-callback?code={authorisation_code}\nResponse body includes:\n- grant_type:authorization_code\n- code:\"381553a0-d173-4df9-ac5f-5ed167dxxxxx\"\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"ol","attributes":{"start":2},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Class authenticates the user and prompts them to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["authorise the requested access"]},". The user will need to provide their Class credentials including their MFA. This step is handled by the Class App during the first step above."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Your Application makes a token request to the Class token endpoint and includes the authorisation_code obtained above."]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"https://apigateway.class.com.au/connect/token \n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Class returns a token response containing the access token and, if requested, an id_token and/or refresh token. It also returns the scope granted."]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"Response body includes:        \n\"token_type\":\"bearer\",\n\"access_token\":\"gIcXxxp90FodZ8wFhdiEimminDE4Y1dTbW2AfhS859-xxxxxx\",\n\"id_token\":\"eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ij-xxxxxx\",\n\"refresh_token\":\"a2a86079-4885-44ec-9233-ac629a4xxxxx\",\n\"expires_in\":\"899\",\n\"BusinessName\":\"{Customer_Business_Name}\",\n\"BusinessCode\":\"{Customer_Business_Code}\",\n\"scope\":\"class_profile openid offline_access target:b/{Customer_Business_Code}\"\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"ol","attributes":{"start":4},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Your application calls the Class API endpoint and exchange Access token for data"]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"authorisation-header","__idx":2},"children":["Authorisation Header"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Requests involved in this flow require basic authentication using the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_id"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_secret"]}," issued for your Application/integraiton. The authorisation header is case-sensitive, including the word Basic. It can be constructed as follows:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Concatenate the client_id and client_secret, separated by a single colon"," ","for example: <client_id>:<client_secret>`"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Base64 encode the authentication string above, for example: PGNsaWVudF9pZD46PGNsaWVudF9zZWNyZXTvu78+"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Include the Base64 encoded authentication string in the Authorisation request header, preceded by the string \"Basic\"."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Example header (placeholder value):"]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"# Authorisation header example\nAuthorization: Basic PGNsaWVudF9pZD46PGNsaWVudF9zZWNyZXTvu78+\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The authorisation request prompts the user for consent, then redirects them to the specified ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["redirect_uri"]},". If successful, the redirect includes an authorization ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["code"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Requests are made via HTTP ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["GET"]}," to the authorisation endpoint. The endpoint URI should be obtained dynamically from the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["authorization_endpoint"]}," field of the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://help.class.com.au/display/PUG/Discovery+document"},"children":["Discovery document"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Authorisation Query Parameters:"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The following query parameters are supported for authorisation requests:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Parameter"},"children":["Parameter"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Required"},"children":["Required"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Value"},"children":["Value"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["response_type"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["True"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["code"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Must be ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["code"]}," for this flow."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_id"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["True"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Your issued client ID"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Identifies your integration."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["redirect_uri"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["True"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["One of your registered redirect URIs"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Must ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["exactly"]}," match a registered redirect URI (including protocol, case, and any trailing character). A query string may be included and will be echoed back."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["scope"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["False"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Space-delimited list"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Describes requested access. See ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Authorisation scope"]}," docs."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["state"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["True"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Any string"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Echoed back to mitigate CSRF. ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Class mandates"]}," using a random, unlinked value. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"http://tools.ietf.org/html/rfc6749#section-10.12"},"children":["RFC6749 §10.12"]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["response_mode"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["False"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["query"]}," (default) or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["form_post"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Select how the authorisation response is returned."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["prompt"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["False"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["none"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["login"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["consent"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Controls login/consent prompting. Multiple values may be space-delimited (except ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["none"]},")."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["login_hint"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["False"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Email address"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Pre-fills the login email field."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Example authorization request (wrapped for readability):"]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"GET https://apigateway.class.com.au/connect/authorize?\nresponse_type=code& \nclient_id={Your ClientId for your Application}& \nscope=class_profile openid offline_access fund.read&\nredirect_uri=https://.application.yourdomain.com.au/class_oauth_callback&\nstate=security_token%Y2eeg2eCMB5owJ&\nprompt=consent \n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"authorisation-response","__idx":3},"children":["Authorisation Response"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Once the request has been handled by the authorisation server, the user will be redirected to the URI specified in the redirect_uri parameter in the request."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For unsuccessful requests, the response consists of a single parameter, error, with an error value as described in Error codes."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["successful"]}," requests, the response parameters are as follows:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Parameter"},"children":["Parameter"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Value"},"children":["Value"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["code"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["An authorisation code"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["An authorisation code that can be exchanged for an access token. As described in the following section."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["state"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Any string"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The same value that was specified for the state parameter in the authorisation request."]}]}]}]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"token-request","__idx":4},"children":["Token Request"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The token request is used to exchange the authorisation code from the authorisation response for an access token that can be used to access the Class API."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Requests are made via an HTTP POST request to the token endpoint. https://apigateway.class.com.au/connect/token"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The following parameters are supported for token requests:"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Parameters:"]}]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Parameter"},"children":["Parameter"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Required"},"children":["Required"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Value"},"children":["Value"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["grant_type"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["True"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["authorization_code"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Must be ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["authorization_code"]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["code"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["True"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Authorization code"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Single-use code from the authorization response."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["redirect_uri"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["True"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Same as before"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Must ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["exactly"]}," match the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["redirect_uri"]}," used in Step 3."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Example token request:"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Request Headers"]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"POST https://apigateway.class.com.au/connect/token\nAuthorization: Basic PGNsaWVudF9pZD46PGNsaWVudF9zZWNyZXTvu78+\nContent-Type: application/x-www-form-urlencoded; charset=utf-8\nHost: app.class.com.au\nContent-Length: 123\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Request Body"]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"grant_type=authorization_code&\ncode=1fd827c4-9ea3-4290-a99a-84c7d62d8b11&\nredirect_uri=https%3a%2f%2fapp.class.com.au%2foauth-callback\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"token-response","__idx":5},"children":["Token Response"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The token endpoint returns a response in JSON format."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For unsuccessful requests, the JSON object will contain two properties, error with an error value as described in Error codes, and error_description containing a more specific, human-readable error message."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For successful requests, the JSON object will contain the following properties:"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Success example:"]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"# HTTP/1.1 200 OK\n# Content-Type: application/json;charset=UTF-8\n# Cache-Control: no-cache\n# Pragma: no-cache\n\n{\n  \"access_token\": \"CBfgN5Z5...\",\n  \"token_type\": \"bearer\",\n  \"expires_in\": \"899\",\n  \"scope\": \"target:b/OAUTH_TEST offline_access business.fund.create fund.read\",\n  \"refresh_token\": \"9e0fccdb-ec4f-4e6a-ae60-83ad66be9547\",\n  \"BusinessName\": \"OAuth Test Business\",\n  \"BusinessCode\": \"OAUTH_TEST\"\n}\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Error example:"]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"# HTTP/1.1 400 Bad Request\n# Content-Type: application/json;charset=UTF-8\n# Cache-Control: no-cache\n# Pragma: no-cache\n\n{\n  \"error\": \"invalid_client\",\n  \"error_description\": \"Client authentication failed\"\n}\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"refresh-token-request","__idx":6},"children":["Refresh Token Request"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["offline_access"]}," was included in ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["scope"]},", you can exchange the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["refresh_token"]}," for a new ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["access_token"]}," ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["without user interaction"]},". Each refresh token is typically ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["single-use"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Parameters:"]}]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Parameter"},"children":["Parameter"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Required"},"children":["Required"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Value"},"children":["Value"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["grant_type"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["True"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["refresh_token"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Must be ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["refresh_token"]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["refresh_token"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["True"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Your refresh token"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["From the previous token response."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Example refresh request:"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Request Headers"]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"POST https://apigateway.class.com.au/connect/token\nAuthorization: Basic PGNsaWVudF9pZD46PGNsaWVudF9zZWNyZXTvu78+\nContent-Type: application/x-www-form-urlencoded; charset=utf-8\nHost: app.class.com.au\nContent-Length: 98\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Request Body"]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"grant_type=refresh_token&\nrefresh_token=9e0fccdb-ec4f-4e6a-ae60-83ad66be9547\n\n"},"children":[]}]},"headings":[{"value":"OAuth 2.0 Authorisation Code Flow – Class API","id":"oauth-20-authorisation-code-flow--class-api","depth":1},{"value":"Flow Overview","id":"flow-overview","depth":2},{"value":"Authorisation Header","id":"authorisation-header","depth":2},{"value":"Authorisation Response","id":"authorisation-response","depth":2},{"value":"Token Request","id":"token-request","depth":2},{"value":"Token Response","id":"token-response","depth":2},{"value":"Refresh Token Request","id":"refresh-token-request","depth":2}],"frontmatter":{"seo":{"title":"OAuth 2.0 Authorisation Code Flow – Class API"}},"lastModified":"2026-04-29T02:30:44.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/products/class/resources/authorisation-code-flow","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}