Resource Owner Password Flow

The Resource Owner Password Credentials (ROPC) Flow is an OAuth 2.0 grant type that enables the client application to obtain a JSON Web Token (JWT) security token by directly exchanging the resource owner’s (user’s) credentials. Unlike the Authorization Code Grant Flow—which involves redirecting the end-user to a login page—this method requires that the client collects the user’s username and password securely and sends them directly to NowInfinity’s authentication server.

Step 1: Securely Collect User Credentials

Before making any token requests, your client application must have the following:

• Your login credentials of username and password to the Nowinfinity application.
• Your API credentials of Client ID and Client Secret that was provided to you from Nowinfinity API team. 

Step 2: Request a Token

Once the user’s credentials have been obtained, your application will exchange them for a JWT by sending a POST request to NowInfinity’s token endpoint:

Token Endpoint URL:

https://auth.nowinfinity.com.au/connect/token

Request Form Fields:

Authorisation Header

Requests involved in this flow require basic authentication using the client_id and client_secret issued for your Application/integration. The authorization header is case-sensitive, including the word Basic. It can be constructed as follows:

1. Concatenate the client_id and client_secret, separated by a single colon
   for example: <client_id>:<client_secret>
2. Base64 encode the authentication string above, for example: PGNsaWVudF9pZD46PGNsaWVudF9zZWNyZXTvu78+
3. Include the Base64 encoded authentication string in the Authorization request header, preceded by the string "Basic".

Authorization: Basic PGNsaWVudF9pZD46PGNsaWVudF9zZWNyZXTvu78+

Example Request:

POST  https://auth.nowinfinity.com.au/connect/token
      Content-Type: application/x-www-form-urlencoded charset=utf-8
      Content-Length: 98
      grant_type=password&
      username=user@example.com&
      password=user_password&
      client_id=my_client_id&
      client_secret=my_client_secret&
      scope=api1%20offline_access%20read%20write

Upon a successful request, the NowInfinity auth server will return a JSON object containing the access token, its type, expiry information, and a refresh token (if applicable).

Example Successful Response:

HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
Content-Length: 1014
Cache-Control: no-store, no-cache, max-age=0, private
Pragma: no-cache

{
"access_token":"CBfgN5Z5...",
"expires_in":360,
"token_type":"bearer",
"refresh_toke": "228b63754887325967ed6a905c38472d
}

If any of the provided form values (such as client_id, client_secret, username, or password) are incorrect or invalid, the auth server will return an error response similar to:

{
   "error": "invalid_grant"
}