OAuth 2.0 Authorisation Code Flow

The Authorisation Code Flow is the recommended and most secure way to access the NowInfinity Partner API. It is the only flow available to Partners, and NowInfinity recommends it for Clients as well.

The flow keeps your client secret confidential, supports refresh tokens, and gives each customer an explicit consent step where they can see what your application is asking for.

Flow overview

1. Send the user to the authorisation endpoint. Your integration redirects the user to NowInfinity, identifying your application and the scopes you need.

2. The user signs in and consents. NowInfinity authenticates the user and presents a consent screen listing the access you requested. The consent screen is always shown for Partner integrations.

3. NowInfinity redirects back to your application with an authorisation code appended to your registered redirect URI.

4. Exchange the code for tokens. Your application posts the authorisation code to the token endpoint and receives a JWT access token, and a refresh token if you requested offline_access.

5. Call the API. Send the access token as a Bearer token against the Partner API.

The examples below use the Test environment. See Environments for production endpoints.

Step 1: Request an authorisation code

Redirect the user to the authorisation endpoint:

https://auth.nowinfinity-test.com.au/connect/authorize

Query parameters

Parameter	Required	Value	Description
`client_id`	Yes	Your issued client ID	Identifies your application.
`response_type`	Yes	`code`	Must be `code` for this flow.
`redirect_uri`	Yes	One of your registered redirect URIs	Must exactly match a registered URI, including protocol, case and any trailing character.
`scope`	Yes	Space-delimited list	The access you are requesting. See Authorisation Scopes.
`state`	Yes	An unguessable random string	Echoed back to you, to mitigate CSRF. See below.
`display`	No	`popup`	Renders the sign-in page for display in a popup window. Omit for a full page.

state is mandatory. It must be a random value that cannot be guessed or linked to the user, and you must verify that the value returned to your redirect URI matches the one you sent. Without it, your integration is open to cross-site request forgery. Partner integrations are checked for correct state handling during production readiness.

Example request (wrapped for readability):

GET https://auth.nowinfinity-test.com.au/connect/authorize?
client_id={your_client_id}&
response_type=code&
redirect_uri=https://yourapp.yourdomain.com.au/ni-callback&
scope=api1 offline_access read write&
state=Y2eeg2eCMB5owJ

Step 2: Handle the redirect

After the user consents, NowInfinity redirects to your registered URI:

https://yourapp.yourdomain.com.au/ni-callback?code={authorisation_code}&state=Y2eeg2eCMB5owJ

Before doing anything else, verify that state matches the value you sent. If it does not, discard the response.

If the request was unsuccessful, an error parameter is returned instead of code. See Error codes.

Authorisation codes are single-use and short-lived. Exchange the code promptly.

Step 3: Exchange the code for tokens

Send an HTTP POST to the token endpoint:

https://auth.nowinfinity-test.com.au/connect/token

Parameters

Parameter	Required	Value	Description
`grant_type`	Yes	`authorization_code`	Must be `authorization_code`.
`code`	Yes	The authorisation code	From the redirect in step 2.
`redirect_uri`	Yes	Same as step 1	Must exactly match the URI used to obtain the code.

Client authentication

The token endpoint accepts client credentials either as form fields (client_id and client_secret in the request body) or as an HTTP Basic Authorization header. Either is acceptable; use whichever your HTTP library handles more cleanly.

To build a Basic header, concatenate the client ID and secret separated by a colon, Base64-encode the result, and prefix it with Basic:

Authorization: Basic {base64(client_id:client_secret)}

The Authorization header is case-sensitive, including the word Basic.

Example request

curl -X POST https://auth.nowinfinity-test.com.au/connect/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=authorization_code" \
  -d "code={authorisation_code}" \
  -d "redirect_uri=https://yourapp.yourdomain.com.au/ni-callback" \
  -d "client_id={your_client_id}" \
  -d "client_secret={your_client_secret}"

Token response

{
  "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "222f4988703c8a36b8bcd4191b776063"
}

access_token — a JWT, sent as a Bearer token on API calls.
expires_in — seconds until the access token expires. Read this value rather than assuming a fixed lifetime.
refresh_token — returned only if offline_access was in the granted scope.

For unsuccessful requests the response contains an error and an error_description. See Error codes.

Step 4: Call the API

Send the access token as a Bearer token:

curl https://partnerapi.nowinfinity-test.com.au/v1/accounts \
  -H "Authorization: Bearer {access_token}"

See API structure for headers, response formats and status codes.

Authorisation Scopes — what to request.
Managing Access and Refresh Tokens — lifetimes and rotation.
Environments — Test and Production endpoints.
Error codes — what went wrong.