{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-products/nowinfinity/resources/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition"]},"type":"markdown"},"seo":{"title":"Resource Owner Password Flow"},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"resource-owner-password-flow","__idx":0},"children":["Resource Owner Password Flow"]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["This flow is available to Clients only"]}," — NowInfinity customers accessing their own data. Partners and third-party integrations must use the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/nowinfinity/resources/authorisation-code-flow"},"children":["Authorisation Code Flow"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["NowInfinity also recommends the Authorisation Code Flow for Clients. It is more secure, since your integration never handles user passwords, and it gives a clearer audit trail of which user performed which action."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Resource Owner Password Credentials (ROPC)"]}," grant is an OAuth 2.0 flow for trusted clients to obtain an access token by sending a user's username and password directly to the token endpoint."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["With this flow you can:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Authenticate a user by sending their credentials to the authorisation server."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Obtain an access token to call the Partner API."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Receive a refresh token, if ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["offline_access"]}," is in the granted scope."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["There is no browser redirect and no consent screen — which is precisely why it is restricted to integrations accessing their own organisation's data."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"token-endpoints","__idx":1},"children":["Token endpoints"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Production:"]}," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://auth.nowinfinity.com.au/connect/token"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Test:"]}," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://auth.nowinfinity-test.com.au/connect/token"]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"client-authentication","__idx":2},"children":["Client authentication"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The token endpoint accepts client credentials either as form fields in the request body or as an HTTP Basic ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Authorization"]}," header."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["To build a Basic header, concatenate the client ID and secret separated by a colon, Base64-encode the result, and prefix it with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Basic"]},":"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"Authorization: Basic {base64(client_id:client_secret)}\n"},"children":[]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Authorization"]}," header is case-sensitive, including the word ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Basic"]},"."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"parameters","__idx":3},"children":["Parameters"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Parameter"},"children":["Parameter"]},{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Required"},"children":["Required"]},{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Value"},"children":["Value"]},{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["grant_type"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Yes"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["password"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Must be ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["password"]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["username"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Yes"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["String"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["The username of the resource owner."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["password"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Yes"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["String"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["The password of the resource owner."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["scope"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Yes"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Space-delimited list"]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["The access being requested. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/nowinfinity/resources/authorisation-scopes"},"children":["Authorisation Scopes"]},"."]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"example-request","__idx":4},"children":["Example request"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"curl -X POST https://auth.nowinfinity-test.com.au/connect/token \\\n  -H \"Content-Type: application/x-www-form-urlencoded\" \\\n  -d \"grant_type=password\" \\\n  -d \"username={username}\" \\\n  -d \"password={password}\" \\\n  -d \"scope=api1 read\" \\\n  -d \"client_id={your_client_id}\" \\\n  -d \"client_secret={your_client_secret}\"\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"token-response","__idx":5},"children":["Token response"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n  \"access_token\": \"eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6...\",\n  \"token_type\": \"Bearer\",\n  \"expires_in\": 3600\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Property"},"children":["Property"]},{"$$mdtype":"Tag","name":"th","attributes":{"align":"left","data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["access_token"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["The JWT used to call the Partner API."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["token_type"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Always ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Bearer"]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["expires_in"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Seconds until the access token expires. Read this value rather than assuming a fixed lifetime."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["refresh_token"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["Returned only if ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["offline_access"]}," was in the granted scope."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["scope"]}]},{"$$mdtype":"Tag","name":"td","attributes":{"align":"left"},"children":["The scope actually granted, which may be narrower than requested."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For unsuccessful requests the response contains an ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["error"]}," and an ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["error_description"]},". See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/nowinfinity/resources/error-codes"},"children":["Error codes"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"handling-credentials","__idx":6},"children":["Handling credentials"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Because this flow requires your integration to handle a user's password directly, a few things matter more than usual:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Never store the password. Use it to obtain a token and discard it."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Request ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["offline_access"]}," so you can refresh without re-prompting, rather than holding credentials to re-authenticate later."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Send requests over ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https"]}," only."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"related","__idx":7},"children":["Related"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/nowinfinity/resources/authorisation-code-flow"},"children":["Authorisation Code Flow"]}," — the recommended alternative."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/nowinfinity/resources/refresh-tokens"},"children":["Managing Access and Refresh Tokens"]}," — lifetimes and rotation."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/nowinfinity/resources/environments"},"children":["Environments"]}," — Test and Production endpoints."]}]}]},"headings":[{"value":"Resource Owner Password Flow","id":"resource-owner-password-flow","depth":1},{"value":"Token endpoints","id":"token-endpoints","depth":2},{"value":"Client authentication","id":"client-authentication","depth":2},{"value":"Parameters","id":"parameters","depth":2},{"value":"Example request","id":"example-request","depth":2},{"value":"Token response","id":"token-response","depth":2},{"value":"Handling credentials","id":"handling-credentials","depth":2},{"value":"Related","id":"related","depth":2}],"frontmatter":{"title":"Resource Owner Password Flow","description":"Obtain an access token by sending user credentials directly to the token endpoint. Available to Clients only.","seo":{"title":"Resource Owner Password Flow"}},"lastModified":"2026-10-26T06:25:05.611Z","pagePropGetterError":{"message":"","name":""}},"slug":"/products/nowinfinity/resources/resource-owner-password-flow","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}