This page covers how to obtain OAuth credentials for the Class APIs, for both Partners and Clients.
If you have not yet established which model applies to you, start with Integration models. The onboarding journey common to all products is covered in Request access — this page covers the Class-specific detail.
Partner applications access data belonging to multiple Class businesses, and must use the Authorisation Code Flow.
Have these ready:
- The OAuth redirection endpoint or endpoints for your application.
- Your application logo, in JPG format. Supply it at 180x55px — logos provided at other sizes will be resized.
Redirection endpoints must be absolute URLs using https. They are matched exactly, including protocol, case and any trailing characters.
- Register your interest. Complete the partner application form on the Class website, or email partners@class.com.au.
- Discuss your requirements. The Partnerships manager will contact you to discuss your integration and confirm which APIs you need.
- Complete due diligence and NDA. These are reviewed by our Compliance team. The Partner Agreement and Cyber Security Assessment come later and do not block sandbox access.
- Receive PIE credentials. We issue OAuth credentials for the Partner Integration Environment, along with business codes and sample funds to build against. Provide your redirect URL and logo at this point if you have not already.
- Build your integration. Develop and test against PIE. The Partner Agreement is negotiated in parallel.
- Pass review. We review your application and you complete the Cyber Security Assessment. See Production readiness for what is assessed.
- Receive production credentials. Once the review is approved and the Partner Agreement is signed, we issue production credentials.
Class Clients access their own business data. Both the Authorisation Code Flow and the Resource Owner Password Flow are available. Class recommends the Authorisation Code Flow — it gives a better audit trail of which user made which change, and allows multiple users to authorise access.
You need a current SSLA agreement. If your business holds an LFA or SSA agreement, it must be updated to an SSLA before API access can be granted.
The request must come from an Access Controller in your business. We cannot issue credentials on the request of an individual developer.
Have these ready:
- Which flow you intend to use.
- Which environments you need: PIE, production, or both.
- The email address and mobile number of the key developer who will receive the credentials.
If you are using the Authorisation Code Flow, also provide:
- Your redirection endpoints.
- Your company logo in JPG format, at 180x55px.
- Send your request. Email partners@class.com.au with the details above.
- Review and verification. We review your request and verify your signed agreements.
- Confirmation. We confirm your integration and which environments your access covers.
- Receive your credentials. We issue your OAuth credentials to your nominated key developer.
Treat your client secret as a password. Store it in your backend, never in client-side code, a mobile application bundle, or a source repository. If a secret is exposed, contact us immediately so it can be rotated.
If your business operates several Class business codes, you can request that all of them be added to your OAuth credentials. You will still need a separate access token per business — a token is scoped to one business at a time.
- Environments — hosts, base URLs and what PIE contains.
- Authorisation Code Flow — the recommended flow for both models.
- Authorisation Scopes — what to request, and least-privilege guidance.