{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-products/class/resources/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition"]},"type":"markdown"},"seo":{"title":"Resource Owner Passsword Flow","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"resource-owner-passsword-flow","__idx":0},"children":["Resource Owner Passsword Flow"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"overview","__idx":1},"children":["Overview"]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This flow is only available for use by Class Customers (signed SSLA agreements) accessing their own data.  Partners/integrations must use the Authorisation code flow. Customers are also encouraged to use the Authorisation code for increased security and better audit trail of which users made changes to data, as multiple users can authorise access to the data."]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Where a customer has multiple business codes on Class, you can request that all the codes be added to your OAuth credentials. You will need to obtain a separate access token for each business before exchanging the token for data from that business."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Resource Owner Password Credentials (ROPC)"]}," grant is an OAuth 2.0 flow for ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["trusted clients"]}," to obtain an access token by sending a user’s ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["username"]}," and ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["password"]}," directly to the authorisation server."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["With the Resource Owner Password Flow, you can:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Authenticate a user by sending their credentials to the authorisation server."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Obtain an ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["access token"]}," to call protected Class API endpoints."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["To receive a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["refresh token"]}," (via the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["offline_access"]}," scope) and an ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["ID token"]}," (if supported)."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"img","attributes":{"src":"/assets/resource-owner-password-flow.230e9a481db36f9f3b8aeef509ce89fda91419fabf78dc020813503c5f05d6c2.9c1bb791.png","alt":"Diagram"},"children":[]}," ",{"$$mdtype":"Tag","name":"sl-details","attributes":{"summary":"1. Client uses email and password"},"children":[" ","Your integration makes a request to the token endpoint containing the username and password of the authorizing user. This request identifies your integration and the scope of resources you wish to access."," "]}," ",{"$$mdtype":"Tag","name":"sl-details","attributes":{"summary":"2. Return access_token and id_token"},"children":[" ","Class returns a token response containing the Access token and, if requested an ID Token."," "]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-1-requesting-a-token","__idx":2},"children":["Step 1: Requesting a Token"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Before calling protected resources, request a access token from the token endpoint."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"token-endpoints","__idx":3},"children":["Token Endpoints"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Production:"]}," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://apigateway.class.com.au/connect/token"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Test (example):"]}," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://apigateway.class-pie.com.au/connect/token"]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"-authorisation-header-basic","__idx":4},"children":["🧾 Authorisation Header (Basic)"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Requests in this flow require ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Basic"]}," authentication using the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_id"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_secret"]}," issued for your Application/integration."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Important:"]}," The ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Authorization"]}," header is ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["case-sensitive"]},", including the word ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Basic"]},"."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Build the header:"]}]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Concatenate ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_id"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_secret"]}," with a colon:"," ","<client_id>:<client_secret>"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Base64-encode that string, for example:"," ","PGNsaWVudF9pZD46PGNsaWVudF9zZWNyZXTvu78+"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Add the result to the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Authorization"]}," header:"," ","Authorization: Basic PGNsaWVudF9pZD46PGNsaWVudF9zZWNyZXTvu78+"]}]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"Authorization: Basic PGNsaWVudF9pZD46PGNsaWVudF9zZWNyZXTvu78+\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"supported-parameters","__idx":5},"children":["Supported Parameters"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The following parameters are supported for token requests:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Parameter"},"children":["Parameter"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Required"},"children":["Required"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Value"},"children":["Value"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["grant_type"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["True"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["password"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The type of OAuth 2.0 grant being exchanged. Must be set to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["password"]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["username"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["True"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["string"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The username of the Resource Owner."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["password"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["True"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["string"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The password of the Resource Owner."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["scope"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["False"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Space-delimited list of scopes"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Describes the access being requested. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/class/resources/authorisation-scopes"},"children":["Authorisation Scopes"]}," for details."]}]}]}]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"example-token-request","__idx":6},"children":["Example Token Request"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["An example token request, with white space added for readability:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"curl -X POST https://apigateway.class-pie.com.au/connect/token \\\n  -H \"Authorization: Basic PGNsaWVudF9pZD46PGNsaWVudF9zZWNyZXTvu78+\" \\\n  -H \"Content-Type: application/x-www-form-urlencoded; charset=utf-8\" \\\n  -d \"grant_type=password&username=SampleUser&password=Samplepwd&scope=target:b/business fund.maintain\"\n\n"},"children":[]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"token-response","__idx":7},"children":["Token response"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The token endpoint returns a response in JSON format."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For unsuccessful requests, the JSON object will contain two properties, error with an error value as described in Error codes, and error_description containing a more specific, human-readable error message."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For successful requests, the JSON object will contain the following properties:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Parameter"},"children":["Parameter"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Value"},"children":["Value"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["access_token"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["An access token"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["This is the token that is used to access user resources via the Class API."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["token_type"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["bearer"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The type of access token. Currently, the Class API only supports Bearer tokens and this property will always have the value bearer."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["expires_in"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Integer"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The number of seconds until the access token expires. I.e. 899."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["scope"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["A space-delimited list of scope values"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The actual scope of the access token. This may be different from what was requested in the scope parameter in the authorisation request. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/class/resources/authorisation-scopes"},"children":["Authorisation Scopes"]}," for a detailed description of this parameter and possible scope values."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["(optional) ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["id_token"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["An ID Token"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["An ID Token containing identity information about the Class user that can be used for authentication. This property will only be included if ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["openid"]}," was included in the authorisation scope parameter."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Examples of successful and unsuccessful token responses, with white space added for readability:"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Successful Response"]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"HTTP/1.1 200 OK\nContent-Type: application/json;charset=UTF-8\nContent-Length: 959\nCache-Control: no-cache\nPragma: no-cache\n \n{\n \"access_token\":\"CBfgN5Z5...\",\n \"token_type\":\"bearer\",\n \"expires_in\":899,\n \"scope\":\"target:b/OAUTH_TEST offline_access business.fund.create fund.read\"\n}\n"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Error Response"]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"HTTP/1.1 400 Bad Request\nContent-Type: application/json;charset=UTF-8\nContent-Length: 77\nCache-Control: no-cache\nPragma: no-cache\n \n{\n \"error\":\"invalid_client\",\n \"error_description\":\"Client authentication failed\"\n}\n"},"children":[]}]},"headings":[{"value":"Resource Owner Passsword Flow","id":"resource-owner-passsword-flow","depth":1},{"value":"Overview","id":"overview","depth":2},{"value":"Step 1: Requesting a Token","id":"step-1-requesting-a-token","depth":2},{"value":"Token Endpoints","id":"token-endpoints","depth":3},{"value":"🧾 Authorisation Header (Basic)","id":"-authorisation-header-basic","depth":3},{"value":"Supported Parameters","id":"supported-parameters","depth":2},{"value":"Example Token Request","id":"example-token-request","depth":2},{"value":"Token response","id":"token-response","depth":2}],"frontmatter":{"seo":{"title":"Resource Owner Passsword Flow"}},"lastModified":"2026-04-29T02:30:44.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/products/class/resources/resource-owner-password-flow","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}