Skip to content
/
Authorisation Code Flow
Last updated

OAuth 2.0 Authorisation Code Grant Flow – NowInfinity API

This article provides a detailed overview of the Authorisation Code Grant Flow for integrating with the NowInfinity API, including step-by-step instructions, example requests, and error handling.

Authorisation Code Grant Flow is the preferred and most secure method to access the NowInfinity API. This flow ensures that sensitive credentials remain confidential and supports secure token exchange for accessing user data.

Flow Overview

The Authorisation Code Grant Flow consists of the following steps:

  1. Request Authorisation Code:
    The client redirects the end-user to the NowInfinity authorisation server to request permission to access the user’s data.

  2. User Grants Permission:
    Upon successful login, the user grants permission, and the authorisation server returns a unique code to the client via the redirect URI.

  3. Exchange Code for Token:
    The client sends the authorisation code to the authorisation server to exchange it for a JWT security token.

  4. Access API:
    The client uses the JWT token to access the NowInfinity API on behalf of the user.

Step 1: Request Authorisation Code

Redirect the end-user to the NowInfinity authorisation server:

https://auth.nowinfinity-test.com.au/connect/authorize

Query Parameters:

ParameterDescriptionExample Value
client_idIdentifies your applicationProvided by NowInfinity
redirect_uriURI to return the user after authenticationDetermined by your application
response_typeOAuth flow type (must be code)code
scopeSpace-delimited list of requested scopesapi1 offline_access read write
stateOptional CSRF token for request/response correlationUnique GUID or identifier
displayOptional: UI display mode (popup or omit)popup (for popup UI), omit for normal page

Example URL:

https://auth.nowinfinity-test.com.au/connect/authorize?client_id=my_client_id&redirect_uri=http%3A%2F%2Fmysite.com&response_type=code&scope=api1%20offline_access%20read%20write

If all parameters are correct, the user will see a login form.
If incorrect credentials are provided, an error message will be displayed.

After login, the user is prompted to grant permission to your application.

Step 2: Exchange Authorisation Code for Security Token

Send a POST request to exchange the authorisation code for a JWT token:

https://auth.nowinfinity-test.com.au/connect/token

Form Fields:

ParameterDescriptionExample Value
grant_typePurpose of request (must be authorization_code)authorization_code
client_idYour application’s client IDProvided by NowInfinity
client_secretYour application’s client secretProvided by NowInfinity
redirect_uriSame redirect URI as in Step 1Same as Step 1
codeAuthorisation code from Step 1Received from redirect

Example Successful Response:

{
  "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6...",
  "expires_in": 360,
  "token_type": "Bearer",
  "refresh_token": "222f4988703c8a36b8bcd4191b776063"
}

Example Error Response:

{
  "error": "invalid_grant"
}

Summary

  • Use the Authorisation Code Grant Flow for secure, server-side integrations with NowInfinity.
  • Always keep your client_secret confidential.
  • Follow the step-by-step process for requesting and exchanging tokens.

If you need further assistance or integration support, please contact partners@class.com.au

Overview

Authorisation Scopes