Resource Owner Passsword Flow

Overview

This flow is only available for use by Class Customers (signed SSLA agreements) accessing their own data. Partners/integrations must use the Authorisation code flow. Customers are also encouraged to use the Authorisation code for increased security and better audit trail of which users made changes to data, as multiple users can authorise access to the data.

Where a customer has multiple business codes on Class, you can request that all the codes be added to your OAuth credentials. You will need to obtain a separate access token for each business before exchanging the token for data from that business.

The Resource Owner Password Credentials (ROPC) grant is an OAuth 2.0 flow for trusted clients to obtain an access token by sending a user’s username and password directly to the authorisation server.

With the Resource Owner Password Flow, you can:

Authenticate a user by sending their credentials to the authorisation server.
Obtain an access token to call protected Class API endpoints.
To receive a refresh token (via the offline_access scope) and an ID token (if supported).

Diagram Your integration makes a request to the token endpoint containing the username and password of the authorizing user. This request identifies your integration and the scope of resources you wish to access. Class returns a token response containing the Access token and, if requested an ID Token.

Step 1: Requesting a Token

Before calling protected resources, request a access token from the token endpoint.

Token Endpoints

Production: https://apigateway.class.com.au/connect/token
Test (example): https://apigateway.class-pie.com.au/connect/token

🧾 Authorisation Header (Basic)

Requests in this flow require Basic authentication using the client_id and client_secret issued for your Application/integration.

Important: The Authorization header is case-sensitive, including the word Basic.

Build the header:

Concatenate client_id and client_secret with a colon: <client_id>:<client_secret>
Base64-encode that string, for example: PGNsaWVudF9pZD46PGNsaWVudF9zZWNyZXTvu78+
Add the result to the Authorization header: Authorization: Basic PGNsaWVudF9pZD46PGNsaWVudF9zZWNyZXTvu78+

Authorization: Basic PGNsaWVudF9pZD46PGNsaWVudF9zZWNyZXTvu78+

Supported Parameters

The following parameters are supported for token requests:

Parameter	Required	Value	Description
`grant_type`	True	`password`	The type of OAuth 2.0 grant being exchanged. Must be set to `password`.
`username`	True	`string`	The username of the Resource Owner.
`password`	True	`string`	The password of the Resource Owner.
`scope`	False	Space-delimited list of scopes	Describes the access being requested. See Authorisation Scopes for details.

Example Token Request

An example token request, with white space added for readability:

curl -X POST https://apigateway.class-pie.com.au/connect/token \
  -H "Authorization: Basic PGNsaWVudF9pZD46PGNsaWVudF9zZWNyZXTvu78+" \
  -H "Content-Type: application/x-www-form-urlencoded; charset=utf-8" \
  -d "grant_type=password&username=SampleUser&password=Samplepwd&scope=target:b/business fund.maintain"

Token response

The token endpoint returns a response in JSON format.

For unsuccessful requests, the JSON object will contain two properties, error with an error value as described in Error codes, and error_description containing a more specific, human-readable error message.

For successful requests, the JSON object will contain the following properties:

Parameter	Value	Description
`access_token`	An access token	This is the token that is used to access user resources via the Class API.
`token_type`	bearer	The type of access token. Currently, the Class API only supports Bearer tokens and this property will always have the value bearer.
`expires_in`	Integer	The number of seconds until the access token expires. I.e. 899.
`scope`	A space-delimited list of scope values	The actual scope of the access token. This may be different from what was requested in the scope parameter in the authorisation request. See Authorisation Scopes for a detailed description of this parameter and possible scope values.
(optional) `id_token`	An ID Token	An ID Token containing identity information about the Class user that can be used for authentication. This property will only be included if openid was included in the authorisation scope parameter.

Examples of successful and unsuccessful token responses, with white space added for readability:

Successful Response

HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
Content-Length: 959
Cache-Control: no-cache
Pragma: no-cache
 
{
 "access_token":"CBfgN5Z5...",
 "token_type":"bearer",
 "expires_in":899,
 "scope":"target:b/OAUTH_TEST offline_access business.fund.create fund.read"
}

Error Response

HTTP/1.1 400 Bad Request
Content-Type: application/json;charset=UTF-8
Content-Length: 77
Cache-Control: no-cache
Pragma: no-cache
 
{
 "error":"invalid_client",
 "error_description":"Client authentication failed"
}