## Actuarial Certificate — Authentication

The Actuarial Certificate callback endpoints are protected by OAuth 2.0 using the **Resource Owner Password Flow** with Bearer tokens.

Every request your system makes to a Class callback endpoint must include a valid bearer token in the `Authorization` header. The token must belong to the provider login account Class set up for you, which carries a special role required to call these endpoints.

There are two authentication directions in this integration:

- **Provider → Class** (covered here) — always OAuth password grant, described below.
- **Class → Provider** (the initial request) — agreed per provider during onboarding; see [Registration](/products/class/apis/actuarial-provider/registration).


### Credentials you need

| Credential | Where it comes from |
|  --- | --- |
| **Client ID** | Provided by Class during registration. Different per environment. |
| **Client Secret** | Provided by Class during registration. Different per environment. |
| **Provider login (username)** | The Class user account set up for your integration during registration. |
| **Provider login password** | The password for that account. |


### Requesting a token

Make a POST to the token endpoint. Note the token endpoint is on the **app** host, not the **apigateway** host.

| Environment | Token URL |
|  --- | --- |
| PIE (Sandbox) | `https://app.class-pie.com.au/connect/token` |
| Production | `https://app.class.com.au/connect/token` |


**Example request** — `Content-Type: application/x-www-form-urlencoded`:

```
POST /connect/token HTTP/1.1
Host: app.class-pie.com.au
Content-Type: application/x-www-form-urlencoded

grant_type=password
&client_id=your-client-id
&client_secret=your-client-secret
&username=your-provider-login
&password=your-provider-login-password
```

**Example response:**

```json
{
    "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6...",
    "expires_in": 900,
    "token_type": "Bearer",
    "scope": "fund.read"
}
```

### Using the token

Attach the token as a Bearer token in the `Authorization` header of every callback request:

```
POST /api/1.0/c/service-provider/{providerId}/actuary/certificate-request/{requestId}/status HTTP/1.1
Host: apigateway.class-pie.com.au
Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6...
Content-Type: application/json

{ ... }
```

### Scope

The certificate endpoints require the **`fund.read`** scope. Although creating and updating a status are write operations, access is granted through the provider login's role rather than a maintain scope, so `fund.read` is sufficient.

### Token lifespan

- Access tokens are valid for **15 minutes** (`expires_in: 900`).
- After expiry, request a new token using the same password flow.
- Refresh tokens are **not** issued for this flow.


### Reference

- [Resource Owner Password Flow](/products/class/resources/resource-owner-password-flow)
- [RFC 6750 — Bearer Token Usage](http://tools.ietf.org/html/rfc6750)