# One Click Audit — Authentication

The One Click Audit callback API is protected by OAuth 2.0 using **Resource Owner Password Flow** with Bearer tokens.

Every request your system makes to the Class callback endpoint must include a valid bearer token in the `Authorization` header.

## Credentials you need

Before you can obtain a token, you need four pieces of information:

| Credential | Where it comes from |
|  --- | --- |
| **Client ID** | Provided by Class during registration. Different per environment. |
| **Client Secret** | Provided by Class during registration. Different per environment. |
| **Provider Login (username)** | The email address you nominated during registration. |
| **Provider Login Password** | Set by *you* during the acceptance process (see below). |


## The acceptance process

For your Client ID and Client Secret to be usable, a Class user must first add a user with your registered Provider Login email address and make them an auditor.

That action triggers Class to send an invitation email to the Provider Login address. You must:

1. Open the invitation email.
2. Follow the acceptance link.
3. Set a password for the Provider Login account.


The password you set here is the password you'll use in the Resource Owner Password Flow.

## Requesting a token

Make a POST to the token endpoint:

| Environment | Token URL |
|  --- | --- |
| PIE (Sandbox) | `https://apigateway.class-pie.com.au/connect/token` |
| Production | `https://apigateway.class.com.au/connect/token` |


**Example request:**

```http
POST /connect/token HTTP/1.1
Host: apigateway.class-pie.com.au
Content-Type: application/x-www-form-urlencoded

grant_type=password
&client_id=your-client-id
&client_secret=your-client-secret
&username=auditor-login@example.com
&password=your-provider-login-password
```

**Example response:**

```json
{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6...",
  "expires_in": 1800,
  "token_type": "Bearer"
}
```

## Using the token

Attach the token as a Bearer token in the `Authorization` header of every callback request:

```http
POST /api/1.0/f/demo-business/demo-fund/externalproviders/demo-auditor/AuditService/submit/a9e9cfce-e3b5-4077-b824-77d23a109ae3 HTTP/1.1
Host: apigateway.class-pie.com.au
Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6...
Content-Type: application/json

{ ... }
```

## Token lifespan

- Access tokens are valid for **30 minutes**.
- After expiry, request a new token using the same Resource Owner Password Flow.
- Refresh tokens are **not** issued for this flow.


## Reference

- [RFC 6750 — Bearer Token Usage](http://tools.ietf.org/html/rfc6750)
- [Class documentation — Resource Owner Password Flow](/products/class/resources/resource-owner-password-flow)