Authentication

The Classy API follows the OAuth2 protocol for authentication. The API credentials provided to your application by Classy allow your application to retrieve an access token, granting access to Classy APIs.

Your Classy API credentials consist of:

Registered Applications will require a client_id and a client_secret in order to fetch an access token to communicate with the Classy API. Your client_secret is secure information that should not be shared, hard-coded into an application, or pushed into a public repository.

Requesting Access

API credentials may be created through your organization’s admin dashboard.

Access Tokens

All API calls require a valid access token. Access tokens must be provided through Authorization headers in the API request.

Obtaining an app access token

An app access token is a token that is tight to your application instead of a specific user. Such a token grants read and write access to the API resources that belong to your organization.

To retrieve an app access token, you must use your API credentials ("client_id" and "client_secret") you obtained when registering your app, and make the following request:

POST /oauth2/auth HTTP/1.1 Host: api.classy.org Content-Type: application/x-www-form-urlencoded grant_type=client_credentials&client_id=CLIENT_ID&client_secret=CLIENT_SECRET

Sample cURL request:

curl --request POST 'https://api.classy.org/oauth2/auth' --data "grant_type=client_credentials&client_id=CLIENT_ID&client_secret=CLIENT_SECRET"

Sample token response:

HTTP/1.1 200 OK Content-Type: application/json { "access_token": "f22d113d5bad4472c4bcb208f39c959b", "expires_in": 3600, "token_type": "bearer" }

"expires_in" defines the lifetime of the token in seconds. When your app access token is expired, you must renew this call to get a new one.

Using an Access Token

To be authenticated a request must send an access token through the Authorization HTTP header. The Classy API only supports "Bearer" access tokens.

HTTP request with access token:

GET /2.0/resource HTTP/1.1 Host: api.classy.com Authorization: Bearer a2eccdb8B35c

Refreshing an Access Token

If the access token was shipped with a refresh token, the refresh token can be used to generate a new access token if the original one expired:

POST /oauth2/auth HTTP/1.1 Host: api.classy.org Content-Type: application/x-www-form-urlencoded grant_type=refresh_token&client_id=CLIENT_ID&client_secret=CLIENT_SECRET&refresh_token=REFRESH_TOKEN