diff --git a/.coveragerc b/.coveragerc
index d09fe9c..fce4122 100644
--- a/.coveragerc
+++ b/.coveragerc
@@ -2,4 +2,4 @@
 omit =
     */python?.?/*
     */site-packages/nose/*
-    tests.py
+    test/*
diff --git a/.gitignore b/.gitignore
index ced8d90..c8671e5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -54,3 +54,7 @@ Icon
 
 ### Added by etg
 setenv
+
+### Added by ndm
+venv
+.idea
\ No newline at end of file
diff --git a/.travis.yml b/.travis.yml
index c973ea5..c172711 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,9 +1,10 @@
 language: python
 python:
   - 2.6
+  - 2.7
 install:
   - pip install -r requirements.txt --use-mirrors
 script:
-  nosetests tests.py --with-coverage --cover-package=toopher
+  nosetests --with-coverage test
 after_success:
   coveralls
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
deleted file mode 100644
index dc36c5f..0000000
--- a/CONTRIBUTING.md
+++ /dev/null
@@ -1,18 +0,0 @@
-# ToopherAPI Python Client
-
-#### Python Version
->=2.6.0
-
-#### Installing Dependencies
-Toopher uses [pip](https://pypi.python.org/pypi/pip) to install packages.
-
-To ensure all dependencies are up-to-date run:
-```shell
-$ pip install -r requirements.txt
-```
-
-#### Tests
-To run tests enter:
-```shell
-$ python tests.py
-```
diff --git a/README-Iframe.md b/README-Iframe.md
deleted file mode 100644
index ed10347..0000000
--- a/README-Iframe.md
+++ /dev/null
@@ -1,119 +0,0 @@
-Authenticating using the Toopher `<iframe>`
-===========================================
-Toopher's `<iframe>`-based authentication flow is the simplest way for web developers to integrate Toopher Two-Factor Authentication into an application.
-
-## Toopher `<iframe>` Authentication Overview
-
-The `iframe`-based authentication flow works by inserting an `<iframe>` element into the HTML displayed to the user after a successful username/password validation (but before they are actually logged-in to the service).  The iframe URL is generated by our library and its content is served from the Toopher API server.  The iframe guides the user through the process of authenticating with Toopher.  Once complete, the iframe will return the result of the authentication to your server by `POST`ing the response via HTML to an endpoint of your choice.  Your server validates the cryptographic signature using our library which determines whether or not the user successfully authenticated.
-
-Two distinct iframe flows are required: 
-
-* the *Pairing* request is used to pair a user account with a particular mobile device (this is typically a one-time process)
-* the *Authentication* request to authenticate a particular action on behalf of a user
-
-## Authentication Workflow
-### Primary Authentication
-We recommend using some form of primary authentication before initiating a Toopher authentication request.  Typical primary authentication methods involve verifying that the user has a valid username and password to access the resource being protected.
-
-### Step 1: Embed a request in an `<iframe>`
-After verifying the user's primary authentication, but before Assuming the user's primary authentication checks out, the next step is to kickoff Toopher authentication.
-
-1. Generate a URI by specifying the request parameters to the library as detailed below
-1. Display a webpage to your user that embeds this URI within an iframe element.  The markup requirements for the iframe element are described in the "HTML Markup" section
-
-### Step 2: Validate the result
-1. Toopher-iframe results posted back to server
-1. Server calls `ToopherIframe.validate()` to verify that result is valid.  `.validate()` returns a `Map` of trusted data if the signature is valid, or throws a `SignatureValidationError` if the signature is invalid.
-1. The server should check for possible errors returned by the API in the `error_code` map entry
-1. If no errors were returned, the result of the authentication is in the `granted` map entry
-
-### HTML markup
-The `<iframe>` element must have an id of `toopher_iframe`.
-
-Pages that include the Toopher Authentication or Pairing iframe must include the accompanying javascript library `toopher-web.js` (located in `/assets/js/` in this repository).  Toopher's Authentication and Pairing `<iframe>` content is designed for a minimum size of 400x300 px.  In the example below, `{{IFRAME_REQUEST_URL}}` is the Authentication or Pairing URL generated by the ToopherIframe library.  `{{POSTBACK_URL}}` is the path on your server where the Toopher-Iframe will submit the result of the authentication when it is finished.
-
-```html
-<!-- toopher-web.js requires jQuery.  uncomment the following line to source it from CDNJS if it is not already included in your page -->
-<!-- <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/1.11.0/jquery.min.js"></script> -->
-<script src="/js/toopher-web.js"></script>
-<iframe id="toopher_iframe" src="{{IFRAME_REQUEST_URL}}" toopher_postback="{{POSTBACK_URL}}" style="display:inline-block; height:300px; width:100%;"></iframe>
-```
-
-There is no difference in the markup required for a Pairing vs. an Authentication iframe request (the generated URI embeds all relevant information).
-
-# Examples
-
-#### Generating an Authentication iframe URI
-Every Toopher Authentication session should include a unique `request_token` - a randomized string that is included in the signed request to the Toopher API and returned in the signed response from the Toopher `<iframe>`.  To guard against potential replay attacks, your code should validate that the returned `request_token` is the same one used to create the request.
-
-Creating a random request token and storing it in the server-side session using Django:
-
-```python
-import random, string
-request_token = ''.join(random.choice(string.lowercase + string.digits) for i in range(15))
-request.session['ToopherRequestToken'] = request_token
-```
-
-The Toopher Authentication API provides the requester a rich set of controls over authentication parameters.
-
-```python
-auth_iframe_url = iframe_api.auth_uri(username, reset_email, action_name, automation_allowed, challenge_required, request_token, requester_metadata, ttl);
-```
-
-For the simple case of authenticating a user at login, a `login_uri` helper method is available:
-
-```python
-login_iframe_url = iframe_api.login_uri(username, reset_email, request_token)
-```
-
-#### Generating a Pairing iframe URI
-
-```python
-pair_iframe_url = iframe_api.pair_uri(username, reset_email)
-```
-
-#### Validating postback data from Authentication iframe and parsing API errors
-In this example, `data` is a `dict` of the form data POSTed to your server from the Toopher Authentication iframe.  You should replace the commented blocks with code appropriate for the condition described in the comment.
-
-```python
-
-request_token = request.session.get('ToopherRequestToken')
-# invalidate the Request Token to guard against replay attacks
-if 'ToopherRequestToken' in request.session:
-    del request.session['ToopherRequestToken']
-
-try:
-    validated_data = iframe_api.validate(data, request_token)
-    if 'error_code' in validated_data:
-        error_code = validated_data['error_code']
-        # check for API errors
-
-        if error_code == toopher.ERROR_CODE_PAIRING_DEACTIVATED:
-            # User deleted the pairing on their mobile device.
-            # 
-            # Your server should display a Toopher Pairing iframe so their account can be re-paired
-            #
-        elif error_code == toopher.ERROR_CODE_USER_DISABLED:
-            # User has been marked as "Opt-Out" in the Toopher API
-            #
-            # If your service allows opt-out, the user should be granted access.
-            #
-        elif error_code == toopher.ERROR_CODE_USER_UNKNOWN:
-            # User has never authenticated with Toopher on this server
-            #
-            # Your server should display a Toopher Pairing iframe so their account can be paired
-            #
-    else:
-        # signature is valid, and no api errors.  check authentication result
-        auth_pending = validated_data.get('pending').lower() == 'true'
-        auth_granted = validated_data.get('granted').lower() == 'true'
-
-        # authentication_result is the ultimate result of Toopher second-factor authentication
-        authentication_result = auth_granted and not auth_pending
-except toopher.SignatureValidationError, e:
-    # signature was invalid.  User should not authenticated
-    # 
-    # e.message will return more information about what specifically
-    # went wrong (incorrect session token, expired TTL, invalid signature)
-    # 
-```
diff --git a/README.md b/README.md
index 6ad702b..179d955 100644
--- a/README.md
+++ b/README.md
@@ -1,27 +1,19 @@
-#ToopherPython
+#ToopherPython [![Build Status](https://travis-ci.org/toopher/toopher-python.png?branch=master)](https://travis-ci.org/toopher/toopher-python)
 
-[![Build Status](https://travis-ci.org/toopher/toopher-python.png?branch=master)](https://travis-ci.org/toopher/toopher-python)
+ToopherPython is a Toopher API library that simplifies the task of interfacing with the Toopher API from Python code.
+  This project wrangles all the dependency libraries and handles the required OAuth and JSON functionality so you can
+  focus on just using the API.
 
-#### Introduction
-ToopherPython is a Toopher API library that simplifies the task of interfacing with the Toopher API from Python code.  This project wrangles all the required OAuth and JSON functionality so you can focus on just using the API.
+### Python Version
+* 3.6
 
-#### Learn the Toopher API
+### Documentation
 Make sure you visit [https://dev.toopher.com](https://dev.toopher.com) to get acquainted with the Toopher API fundamentals.  The documentation there will tell you the details about the operations this API wrapper library provides.
 
-#### OAuth Authentication
-First off, to access the Toopher API you'll need to sign up for an account at the [Toopher developers portal](https://dev.toopher.com) and create a "requester". When that process is complete, your requester is issued OAuth 1.0a credentials in the form of a consumer key and secret. Your key is used to identify your requester when Toopher interacts with your customers, and the secret is used to sign each request so that we know it is generated by you.  This library properly formats each request with your credentials automatically.
+## ToopherApi Workflow
 
-#### The Toopher Two-Step
-Interacting with the Toopher web service involves two steps: pairing, and authenticating.
-
-##### Pair
-Before you can enhance your website's actions with Toopher, your customers will need to pair their phone's Toopher app with your website.  To do this, they generate a unique, nonsensical "pairing phrase" from within the app on their phone.  You will need to prompt them for a pairing phrase as part of the Toopher enrollment process.  Once you have a pairing phrase, just send it to the Toopher web service and we'll return a pairing ID that you can use whenever you want to authenticate an action for that user.
-
-##### Authenticate
-You have complete control over what actions you want to authenticate using Toopher (for example: logging in, changing account information, making a purchase, etc.).  Just send us the user's pairing ID, a name for the terminal they're using, and a description of the action they're trying to perform and we'll make sure they actually want it to happen.
-
-#### Librarified
-This library makes it super simple to do the Toopher two-step.  Check it out:
+### Step 1: Pair
+Before you can enhance your website's actions with Toopher, your customers will need to pair their mobile device's Toopher app with your website.  To do this, they generate a unique pairing phrase from within the app on their mobile device.  You will need to prompt them for a pairing phrase as part of the Toopher enrollment process.  Once you have a pairing phrase, just send it to the Toopher web service along with your requester credentials and we'll return a pairing ID that you can use whenever you want to authenticate an action for that user.
 
 ```python
 import toopher
@@ -29,57 +21,84 @@ import toopher
 # Create an API object using your credentials
 api = toopher.ToopherApi("<your consumer key>", "<your consumer secret>")
 
-# Step 1 - Pair with their phone's Toopher app
-pairing_status = api.pair("pairing phrase", "username@yourservice.com")
+# Step 1 - Pair with their mobile device's Toopher app
+pairing = api.pair("username@yourservice.com", "pairing phrase")
+```
+
+### Step 2: Authenticate
+You have complete control over what actions you want to authenticate using Toopher (logging in, changing account
+information, making a purchase, etc.).  Just send us the username or pairing ID and we'll make sure they actually want it to happen
+. You can also choose to provide the following optional parameters: terminal name, requester specified ID and
+action name (*default: "Log in"*).
 
+```python
 # Step 2 - Authenticate a log in
-auth = api.authenticate(pairing_status.id, "my computer")
+authentication_request = api.authenticate("username@yourservice.com", "terminal name")
 
 # Once they've responded you can then check the status
-auth_status = api.get_authentication_status(auth.id)
-if (auth_status.pending == False and auth_status.granted == True):
+authentication_request.refresh_from_server()
+if not authentication_request.pending and authentication_request.granted:
 	# Success!
 ```
 
-#### Handling Errors
-If any request runs into an error a `ToopherApiError` will be thrown with more details on what went wrong.
+## ToopherIframe Workflow
 
-#### Zero-Storage usage option
-Requesters can choose to integrate the Toopher API in a way does not require storing any per-user data such as Pairing ID and Terminal ID - all of the storage
-is handled by the Toopher API Web Service, allowing your local database to remain unchanged.  If the Toopher API needs more data, it will `raise()` a specific
-error that allows your code to respond appropriately.
+### Step 1: Embed a request in an IFRAME
+1. Generate an authentication URL by providing a username.
+2. Display a webpage to your user that embeds this URL within an `<iframe>` element.
 
 ```python
-try:
-    # optimistically try to authenticate against Toopher API with username and a Terminal Identifier
-    # Terminal Identifer is typically a randomly generated secure browser cookie.  It does not
-    # need to be human-readable
-    auth = api.authenticate_by_user_name(user_name, requester_terminal_id)
-
-    # if you got here, everything is good!  poll the auth request status as described above
-    # there are four distinct errors ToopherAPI can return if it needs more data
-except UserDisabledError:
-    # you have marked this user as disabled in the Toopher API.
-except UserUnknownError:
-    # This user has not yet paired a mobile device with their account.  Pair them
-    # using api.pair() as described above, then re-try authentication
-except TerminalUnknownError:
-    # This user has not assigned a "Friendly Name" to this terminal identifier.
-    # Prompt them to enter a terminal name, then submit that "friendly name" to
-    # the Toopher API:
-    #   api.create_user_terminal(user_name, terminal_name, requester_terminal_id)
-    # Afterwards, re-try authentication
-except PairingDeactivatedError:
-    # this user does not have an active pairing,
-    # typically because they deleted the pairing.  You can prompt
-    # the user to re-pair with a new mobile device.
+import toopher
+
+# Create an API object using your credentials
+iframe_api = toopher.ToopherIframe("<your consumer key>", "<your consumer secret>")
+
+
+auth_iframe_url = iframe_api.get_authentication_url("username@yourservice.com");
+
+# Add an <iframe> element to your HTML:
+# <iframe id="toopher_iframe" src=auth_iframe_url />
 ```
 
-#### Dependencies
-This library uses the [Requests](http://docs.python-requests.org/en/latest/) library to handle OAuth signing and to make the web requests.  If you install using pip (or easy_install) they'll be installed automatically for you. 
+### Step 2: Validate the postback data
+
+The simplest way to validate the postback data is to call `is_authentication_granted` to check if the authentication request was granted.
 
-#### Try it out
-Check out `demo.py` for an example program that walks you through the whole process!  Just download the contents of this repo, make sure you have the dependencies listed above installed, and then run it like-a-this:
+```python
+# Retrieve the postback data as a string from POST parameter 'iframe_postback_data'
+postback_data = request.args['iframe_postback_data']
+
+# Returns boolean indicating if authentication request was granted by user
+authentication_request_granted = iframe_api.is_authentication_granted(postback_data)
+
+if authentication_request_granted:
+    # Success!
+```
+
+### Handling Errors
+If any request runs into an error a `ToopherApiError` will be thrown with more details on what went wrong.
+
+### Demo
+Check out `demo.py` for an example program that walks you through the whole process!  Just download the contents of
+this repo, make sure you have the dependencies installed, and run the command below:
+```shell
+$ python demo.py
+```
+
+## Contributing
+### Dependencies
+This library uses the [Requests](http://docs.python-requests.org/en/latest/) library and [OAuthLib](https://oauthlib.readthedocs.org/en/latest/index.html) to handle OAuth signing and make the web requests.
+
+Toopher uses [pip](https://pypi.python.org/pypi/pip) to install Python packages. To ensure all dependencies are up-to-date run:
 ```shell
-$ python ./demo.py
+$ pip install -r requirements.txt
 ```
+
+### Tests
+To run the tests using [nose](http://nose.readthedocs.org/en/latest/) enter:
+```shell
+$ nosetests test
+```
+
+## License
+ToopherPython is licensed under the MIT License. See LICENSE.txt for the full text.
diff --git a/assets/js/toopher-web.js b/assets/js/toopher-web.js
new file mode 100644
index 0000000..deb2209
--- /dev/null
+++ b/assets/js/toopher-web.js
@@ -0,0 +1,43 @@
+(function(window, $){
+  var postToUrl = function (path, params, method){
+    method = method || 'POST';
+    var form = $('<form />').attr('method', method).attr('action', path);
+    for (var key in params){
+      if (params.hasOwnProperty(key)){
+        var hiddenField = $('<input />').attr('type', 'hidden').attr('name', key).attr('value', params[key]);
+        form.append(hiddenField);
+      }
+    }
+    $('body').append(form);
+    form.submit();
+  }
+
+  var handleMessage = function(e){
+    var msgData = JSON.parse(e.data);
+    if (msgData.status === 'toopher-api-complete'){
+      var iframe = $('#toopher_iframe');
+      var frameworkPostArgsJSON = iframe.attr('framework_post_args');
+      var frameworkPostArgs = {};
+      if(frameworkPostArgsJSON){
+        frameworkPostArgs = $.parseJSON(frameworkPostArgsJSON);
+      }
+      var postData = $.extend({}, msgData.payload, frameworkPostArgs);
+      var toopherData = {'toopher_iframe_data': $.param(postData)};
+
+      if(iframe.attr('use_ajax_postback')){
+      $.post(iframe.attr('toopher_postback'), toopherData)
+        .done(function(data){
+          data = $.parseJSON(data);
+        });
+      } else {
+        postToUrl(iframe.attr('toopher_postback'), toopherData, 'POST');
+      }
+    }
+  }
+
+  if (window.addEventListener) {
+    window.addEventListener('message', handleMessage, false);
+  } else {
+    window.attachEvent('onmessage', handleMessage);
+  }
+})(window, jQuery);
diff --git a/demo.py b/demo.py
index d575cc3..be0fd4e 100755
--- a/demo.py
+++ b/demo.py
@@ -8,33 +8,31 @@
 DEFAULT_USERNAME = 'demo@toopher.com'
 DEFAULT_TERMINAL_NAME = 'my computer'
 
-def print_sep(char='-'):
+def print_horizontal_line(char='-'):
     print char*72
 
+def print_text_with_underline(text, char='-'):
+    print '\n' + text
+    print_horizontal_line(char)
 
-if __name__ == '__main__':
-    print_sep('=')
-    print 'Library Usage Demo'
-    print_sep('=')
-    print
-    
+def initialize_api():
     key = os.environ.get('TOOPHER_CONSUMER_KEY')
     secret = os.environ.get('TOOPHER_CONSUMER_SECRET')
     
     if not (key or secret):
-        print 'Setup Credentials (set environment variables to prevent prompting)'
-        print_sep()
-        print 'Enter your requester credential details (from https://dev.toopher.com)'
+        print_text_with_underline('Setup Credentials')
+        print 'Enter your requester credential details (from https://dev.toopher.com).'
+        print 'Hint: Set the TOOPHER_CONSUMER_SECRET and TOOPHER_CONSUMER_SECRET environment variables to avoid this prompt.'
         while not key:
-            key = raw_input('TOOPHER_CONSUMER_KEY=')
+            key = raw_input('TOOPHER_CONSUMER_KEY: ')
         while not secret:
-            secret = raw_input('TOOPHER_CONSUMER_SECRET=')
+            secret = raw_input('TOOPHER_CONSUMER_SECRET: ')
             
-    api = toopher.ToopherApi(key, secret, os.environ.get('TOOPHER_BASE_URL'))
-    
+    return toopher.ToopherApi(key, secret, os.environ.get('TOOPHER_BASE_URL'))
+
+def pair_device_with_toopher(api):
     while True:
-        print 'Step 1: Pair requester with phone'
-        print_sep('-')
+        print_text_with_underline('Step 1: Pair requester with phone')
         print 'Pairing phrases are generated on the mobile app'
         pairing_phrase = raw_input('Enter pairing phrase: ')
         while not pairing_phrase:
@@ -48,68 +46,75 @@ def print_sep(char='-'):
         print 'Sending pairing request...'
         
         try:
-            pairing_status = api.pair(pairing_phrase, user_name)
-            pairing_id = pairing_status.id
+            pairing = api.pair(user_name, pairing_phrase)
             break
         except ToopherApiError, e:
-            print 'The pairing phrase was not accepted (reason: %s)' % e
+            print 'The pairing phrase was not accepted (Reason: %s)' % e
             
     while True:
+        print
         raw_input('Authorize pairing on phone and then press return to continue.')
         print 'Checking status of pairing request...'
         
         try:
-            pairing_status = api.get_pairing_status(pairing_id)
-            if pairing_status.enabled:
-                print 'Pairing complete'
-                print
+            pairing.refresh_from_server()
+            if pairing.pending:
+                print 'The pairing has not been authorized by the phone yet.'
+            elif pairing.enabled:
+                print 'Pairing complete!'
                 break
             else:
-                print 'The pairing has not been authorized by the phone yet'
+                print 'The pairing has been denied.'
+                break
         except ToopherApiError, e:
             raise
-            print 'Could not check pairing status (reason: %s)' % e
-            
-    terminal_extras = {}
+            print 'Could not check pairing status (Reason: %s)' % e
+
+    return pairing
 
+def authenticate_with_toopher(api, pairing):
     while True:
-        print 'Step 2: Authenticate log in'
-        print_sep()
-        
+        print_text_with_underline('Step 2: Authenticate log in')
         terminal_name = raw_input('Enter a terminal name for this authentication request [%s]: ' % DEFAULT_TERMINAL_NAME)
         if not terminal_name:
             terminal_name = DEFAULT_TERMINAL_NAME
 
-        if terminal_name in terminal_extras:
-            terminal_extra = terminal_extras[terminal_name]
-        else:
-            terminal_extra = terminal_extras[terminal_name] = uuid.uuid4()
-            
         print 'Sending authentication request...'
         
         try:
-            request_status = api.authenticate(pairing_id, terminal_name, terminal_name_extra=terminal_extra)
-            request_id = request_status.id
+            auth_request = api.authenticate(pairing.user.name, terminal_name=terminal_name)
         except ToopherApiError, e:
-            print 'Error initiating authentication (reason: %s)' % e
-            continue
+            print 'Error initiating authentication (Reason: %s)' % e
+            break
         
         while True:
-            raw_input('Response to authentication request on phone (if prompted) and then press return to continue.')
+            print
+            raw_input('Respond to authentication request on phone and then press return to continue.')
             print 'Checking status of authentication request...'
             
             try:
-                request_status = api.get_authentication_status(request_id)
+                auth_request.refresh_from_server()
             except ToopherApiError, e:
-                print 'Could not check authentication status (reason: %s)' % e
+                print 'Could not check authentication request status (Reason: %s)' % e
                 continue
             
-            if request_status.pending:
+            if auth_request.pending:
                 print 'The authentication request has not received a response from the phone yet.'
             else:
-                automation = 'automatically ' if request_status.automated else ''
-                result = 'granted' if request_status.granted else 'denied'
+                automation = 'automatically ' if auth_request.automated else ''
+                result = 'granted' if auth_request.granted else 'denied'
                 print 'The request was ' + automation + result + "!"
                 break
             
-        raw_input('Press return to authenticate again, or Ctrl-C to exit')
+        raw_input('Press return to authenticate again, or Ctrl-C to exit.')
+        print
+
+def demo():
+    api = initialize_api()
+    pairing = pair_device_with_toopher(api)
+    if pairing.enabled:
+       authenticate_with_toopher(api, pairing)
+
+if __name__ == '__main__':
+    print_text_with_underline('Toopher Library Demo', '=')
+    demo()
diff --git a/demo_bells_and_whistles.py b/demo_bells_and_whistles.py
deleted file mode 100755
index af924d5..0000000
--- a/demo_bells_and_whistles.py
+++ /dev/null
@@ -1,139 +0,0 @@
-import os
-import sys
-import uuid
-
-import toopher
-from toopher import ToopherApiError
-import argparse
-
-DEFAULT_USERNAME = 'demo@toopher.com'
-DEFAULT_TERMINAL_NAME = 'my computer'
-
-def print_sep(char='-'):
-    print char*72
-
-
-if __name__ == '__main__':
-    parser = argparse.ArgumentParser(description='Toopher Library Usage Demo')
-    parser.add_argument('--sms', dest='sms_authentication', action='store_true',
-                    help='Use SMS Authentication mode (SMS messages instead of Smartphone push)')
-    parser.add_argument('--sms-inband-reply', dest='sms_inband_reply', action='store_true',
-                    help='Send a OTP to user over SMS for entry through the website (instead of prompting them to reply via SMS).  This option only makes sense if --sms is also supplied.')
-    args = parser.parse_args()
-
-    print_sep('=')
-    print 'Library Usage Demo'
-    print_sep('=')
-    print
-    
-    key = os.environ.get('TOOPHER_CONSUMER_KEY')
-    secret = os.environ.get('TOOPHER_CONSUMER_SECRET')
-    
-    if not (key or secret):
-        print 'Setup Credentials (set environment variables to prevent prompting)'
-        print_sep()
-        print 'Enter your requester credential details (from https://dev.toopher.com)'
-        while not key:
-            key = raw_input('TOOPHER_CONSUMER_KEY=')
-        while not secret:
-            secret = raw_input('TOOPHER_CONSUMER_SECRET=')
-            
-    api = toopher.ToopherApi(key, secret, os.environ.get('TOOPHER_BASE_URL'))
-    
-    while True:
-        print 'Step 1: Pair requester with phone'
-        print_sep('-')
-        if args.sms_authentication:
-            pair_func = api.pair_sms
-            pair_help = 'Non-US numbers should start with a "+" and include the country code.'
-            pair_type = 'mobile number'
-        else:
-            pair_func = api.pair
-            pair_help = 'Pairing phrases are generated on the mobile app'
-            pair_type = 'pairing phrase'
-        
-        print pair_help
-        pairing_key = raw_input('Enter %s: ' % pair_type)
-        while not pairing_key:
-            print 'Please enter a %s to continue' % pair_type
-            pairing_key = raw_input('Enter %s: ' % pair_type)
-            
-        user_name = raw_input('Enter a username for this pairing [%s]: ' % DEFAULT_USERNAME)
-        if not user_name:
-            user_name = DEFAULT_USERNAME
-            
-        print 'Sending pairing request...'
-        
-        try:
-            pairing_status = pair_func(pairing_key, user_name)
-            pairing_id = pairing_status.id
-            break
-        except ToopherApiError, e:
-            print 'The pairing phrase was not accepted (reason: %s)' % e
-            
-    while True:
-        raw_input('Authorize pairing on phone and then press return to continue.')
-        print 'Checking status of pairing request...'
-        
-        try:
-            pairing_status = api.get_pairing_status(pairing_id)
-            if pairing_status.enabled:
-                print 'Pairing complete'
-                print
-                break
-            else:
-                print 'The pairing has not been authorized by the phone yet'
-        except ToopherApiError, e:
-            raise
-            print 'Could not check pairing status (reason: %s)' % e
-            
-    terminal_extras = {}
-
-    while True:
-        print 'Step 2: Authenticate log in'
-        print_sep()
-        
-        terminal_name = raw_input('Enter a terminal name for this authentication request [%s]: ' % DEFAULT_TERMINAL_NAME)
-        if not terminal_name:
-            terminal_name = DEFAULT_TERMINAL_NAME
-
-        if terminal_name in terminal_extras:
-            terminal_extra = terminal_extras[terminal_name]
-        else:
-            terminal_extra = terminal_extras[terminal_name] = uuid.uuid4()
-            
-        print 'Sending authentication request...'
-        
-        try:
-            request_status = api.authenticate(pairing_id, terminal_name, terminal_name_extra=terminal_extra, use_sms_inband_reply=args.sms_inband_reply)
-            request_id = request_status.id
-        except ToopherApiError, e:
-            print 'Error initiating authentication (reason: %s)' % e
-            continue
-        
-        while True:
-            if args.sms_inband_reply:
-                otp = raw_input('Enter the One-Time-Password that was sent to your phone to continue: ')
-            else:
-                otp = None
-                raw_input('Response to authentication request on phone (if prompted) and then press return to continue.')
-            print 'Checking status of authentication request...'
-            
-            try:
-                if otp:
-                    request_status = api.authenticate_with_otp(request_id, otp)
-                else:
-                    request_status = api.get_authentication_status(request_id)
-            except ToopherApiError, e:
-                print 'Could not check authentication status (reason: %s)' % e
-                continue
-            
-            if request_status.pending:
-                print 'The authentication request has not received a response from the phone yet.'
-            else:
-                automation = 'automatically ' if request_status.automated else ''
-                result = 'granted' if request_status.granted else 'denied'
-                print 'The request was ' + automation + result + "!"
-                break
-            
-        raw_input('Press return to authenticate again, or Ctrl-C to exit')
diff --git a/requirements.txt b/requirements.txt
index d9bf92f..89bc81d 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -8,4 +8,3 @@ oauthlib==0.6.0
 requests==2.0.1
 requests-oauthlib==0.4.0
 urllib3==1.7.1
-Werkzeug==0.9.4
diff --git a/setup.py b/setup.py
index 9618583..62218f5 100755
--- a/setup.py
+++ b/setup.py
@@ -3,7 +3,7 @@
 
 setup(
     name='toopher',
-    version='1.1.0',
+    version='2.0.0',
     author='Toopher, Inc.',
     author_email='dev@toopher.com',
     url='https://dev.toopher.com',
diff --git a/test/__init__.py b/test/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/test/test_authentication_request.py b/test/test_authentication_request.py
new file mode 100644
index 0000000..8ec5184
--- /dev/null
+++ b/test/test_authentication_request.py
@@ -0,0 +1,166 @@
+import unittest
+import toopher
+import uuid
+import json
+from .testutils import HttpClientMock
+
+class AuthenticationRequestTests(unittest.TestCase):
+    toopher.DEFAULT_BASE_URL = 'https://api.toopher.test/v1'
+
+    def setUp(self):
+        self.api = toopher.ToopherApi('key', 'secret', 'https://api.toopher.test/v1')
+        self.id = str(uuid.uuid4())
+        self.reason = 'it is a test'
+        self.reason_code = '0'
+        self.user_id = '1'
+        self.user = {
+            'id': self.user_id,
+            'name': 'user_name',
+            'toopher_authentication_enabled': True
+        }
+        self.terminal = {
+            'id': str(uuid.uuid4()),
+            'name': 'terminal_name',
+            'requester_specified_id': 'requester_specified_id',
+            'user': self.user
+        }
+        self.terminal_id = self.terminal['id']
+        self.action = {
+            'id': str(uuid.uuid4()),
+            'name': 'action_name'
+        }
+        self.action_id = self.action['id']
+
+    def test_incomplete_response_raises_exception(self):
+        response = {'key': 'value'}
+        def fn():
+            toopher.AuthenticationRequest(response, self.api)
+        self.assertRaises(toopher.ToopherApiError, fn)
+
+    def test_nonzero_when_granted(self):
+        response = ddict()
+        response['granted'] = True
+        allowed = toopher.AuthenticationRequest(response, self.api)
+        self.assertTrue(allowed)
+
+        response['granted'] = False
+        denied = toopher.AuthenticationRequest(response, self.api)
+        self.assertFalse(denied)
+
+    def test_authenticate_with_otp(self):
+        response = {
+            'id': self.id,
+            'pending':True,
+            'granted':False,
+            'automated': False,
+            'reason': self.reason,
+            'reason_code': self.reason_code,
+            'terminal': self.terminal,
+            'user': self.user,
+            'action': self.action
+        }
+        auth_request = toopher.AuthenticationRequest(response, self.api)
+
+        self.api.advanced.raw.client = HttpClientMock({
+            'authentication_requests/{0}/otp_auth'.format(auth_request.id): (200,
+                json.dumps({
+                    'id': self.id,
+                    'pending': False,
+                    'granted': True,
+                    'automated': True,
+                    'reason': self.reason,
+                    'reason_code': self.reason_code,
+                    'terminal': self.terminal,
+                    'user': self.user,
+                    'action': self.action
+                })
+            )
+        })
+        auth_request.grant_with_otp('otp')
+        self.assertEqual(self.api.advanced.raw.client.last_called_method, 'POST')
+        self.assertEqual(self.api.advanced.raw.client.last_called_data['otp'], 'otp')
+        self.assertFalse(auth_request.pending)
+        self.assertTrue(auth_request.granted)
+        self.assertTrue(auth_request.automated)
+
+    def test_refresh_from_server(self):
+        response = {
+            'id': self.id,
+            'pending': False,
+            'granted': True,
+            'automated': False,
+            'reason': self.reason,
+            'reason_code': self.reason_code,
+            'terminal': self.terminal,
+            'user': self.user,
+            'action': self.action
+        }
+        auth_request = toopher.AuthenticationRequest(response, self.api)
+
+        self.api.advanced.raw.client = HttpClientMock({
+            'authentication_requests/{0}'.format(auth_request.id): (200,
+                json.dumps({
+                    'id': self.id,
+                    'pending': False,
+                    'granted': True,
+                    'automated': True,
+                    'reason': 'it is a test CHANGED',
+                    'reason_code': self.reason_code,
+                    'terminal': {
+                        'id': self.terminal_id,
+                        'name': 'terminal_name changed',
+                        'requester_specified_id': 'requester_specified_id',
+                        'user': self.user
+                    },
+                    'user': {
+                        'id': self.user_id,
+                        'name': 'user_name changed',
+                        'toopher_authentication_enabled': False
+                    },
+                    'action': {
+                        'id': self.action_id,
+                        'name': 'action_name changed'
+                    }
+                })
+            )
+        })
+        auth_request.refresh_from_server()
+        self.assertEqual(self.api.advanced.raw.client.last_called_method, 'GET')
+        self.assertEqual(auth_request.id, self.id)
+        self.assertFalse(auth_request.pending)
+        self.assertTrue(auth_request.granted)
+        self.assertTrue(auth_request.automated)
+        self.assertEqual(auth_request.reason, 'it is a test CHANGED')
+        self.assertEqual(auth_request.reason_code, self.reason_code)
+        self.assertEqual(auth_request.terminal.id, self.terminal_id)
+        self.assertEqual(auth_request.terminal.name, 'terminal_name changed')
+        self.assertEqual(auth_request.user.id, self.user_id)
+        self.assertEqual(auth_request.user.name, 'user_name changed')
+        self.assertFalse(auth_request.user.toopher_authentication_enabled)
+        self.assertEqual(auth_request.action.id, self.action_id)
+        self.assertEqual(auth_request.action.name, 'action_name changed')
+
+    def test_update_with_incomplete_response_raises_exception(self):
+        response = {
+            'id': self.id,
+            'pending':True,
+            'granted':False,
+            'automated': False,
+            'reason': self.reason,
+            'reason_code': self.reason_code,
+            'terminal': self.terminal,
+            'user': self.user,
+            'action': self.action
+        }
+        auth_request = toopher.AuthenticationRequest(response, self.api)
+        def fn():
+            auth_request._update({'key': 'value'})
+        self.assertRaises(toopher.ToopherApiError, fn)
+
+class ddict(dict):
+    def __getitem__(self, key):
+        try:
+            value = super(ddict, self).__getitem__(key)
+            return value
+        except KeyError as e:
+            return ddict()
\ No newline at end of file
diff --git a/test/test_pairing.py b/test/test_pairing.py
new file mode 100644
index 0000000..0fb0ce1
--- /dev/null
+++ b/test/test_pairing.py
@@ -0,0 +1,135 @@
+import toopher
+import unittest
+import uuid
+import json
+from .testutils import HttpClientMock
+
+class PairingTests(unittest.TestCase):
+    toopher.DEFAULT_BASE_URL = 'https://api.toopher.test/v1'
+
+    def setUp(self):
+        self.api = toopher.ToopherApi('key', 'secret', 'https://api.toopher.test/v1')
+        self.id = str(uuid.uuid4())
+        self.user = {
+            'id': str(uuid.uuid4()),
+            'name': 'user_name',
+            'toopher_authentication_enabled': True
+        }
+        self.user_id = self.user['id']
+        self.user_name = self.user['name']
+
+    def test_incomplete_response_raises_exception(self):
+        response = {'key': 'value'}
+        def fn():
+            toopher.Pairing(response, self.api)
+        self.assertRaises(toopher.ToopherApiError, fn)
+
+    def test_nonzero_when_granted(self):
+        response = ddict()
+        response['enabled'] = True
+        allowed = toopher.Pairing(response, self.api)
+        self.assertTrue(allowed)
+
+        response['enabled'] = False
+        denied = toopher.Pairing(response, self.api)
+        self.assertFalse(denied)
+
+    def test_refresh_from_server(self):
+        response = {
+            'id': self.id,
+            'enabled': True,
+            'pending': True,
+            'user': self.user
+        }
+        pairing = toopher.Pairing(response, self.api)
+
+        self.api.advanced.raw.client = HttpClientMock({
+            'pairings/{0}'.format(pairing.id): (200,
+                json.dumps({
+                    'id': self.id,
+                    'enabled': False,
+                    'pending': False,
+                    'user': {
+                        'id': self.user_id,
+                        'name': 'user_name changed',
+                        'toopher_authentication_enabled': False
+                    }
+                })
+            )
+        })
+        pairing.refresh_from_server()
+        self.assertEqual(self.api.advanced.raw.client.last_called_method, 'GET')
+        self.assertEqual(pairing.id, self.id)
+        self.assertEqual(pairing.user.id, self.user_id)
+        self.assertEqual(pairing.user.name, 'user_name changed')
+        self.assertFalse(pairing.user.toopher_authentication_enabled)
+        self.assertFalse(pairing.enabled)
+        self.assertFalse(pairing.pending)
+
+    def test_get_qr_code_image(self):
+        response = {'id': self.id,
+                    'enabled': True,
+                    'pending': True,
+                    'user': self.user }
+        pairing = toopher.Pairing(response, self.api)
+        self.api.advanced.raw.client = HttpClientMock({
+            'qr/pairings/{0}'.format(pairing.id): (200,
+                    '{}')
+        })
+        pairing.get_qr_code_image()
+        self.assertEqual(self.api.advanced.raw.client.last_called_method, 'GET')
+        self.assertEqual(self.api.advanced.raw.client.last_called_uri, 'https://api.toopher.test/v1/qr/pairings/{0}'.format(pairing.id))
+
+    def test_get_reset_link(self):
+        response = {'id':self.id,
+                    'enabled': False,
+                    'pending': True,
+                    'user': self.user }
+        pairing = toopher.Pairing(response, self.api)
+
+        self.api.advanced.raw.client = HttpClientMock({
+            'pairings/{0}/generate_reset_link'.format(self.id): (200,
+                json.dumps({
+                    'url': 'http://api.toopher.test/v1/pairings/{0}/reset?reset_authorization=abcde'.format(self.id)
+                })
+            )
+        })
+        reset_link = pairing.get_reset_link()
+        self.assertEqual('http://api.toopher.test/v1/pairings/{0}/reset?reset_authorization=abcde'.format(self.id), reset_link)
+
+    def test_email_reset_link(self):
+        response = {'id':self.id,
+                    'enabled': False,
+                    'pending': True,
+                    'user': self.user }
+        pairing = toopher.Pairing(response, self.api)
+        self.api.advanced.raw.client = HttpClientMock({
+            'pairings/{0}/send_reset_link'.format(self.id): (201,
+                                           '[]'
+            )
+        })
+        pairing.email_reset_link('email')
+        self.assertEqual(self.api.advanced.raw.client.last_called_method, 'POST')
+        self.assertEqual(self.api.advanced.raw.client.last_called_uri, 'https://api.toopher.test/v1/pairings/' +
+                         self.id + '/send_reset_link')
+        self.assertEqual(self.api.advanced.raw.client.last_called_data['reset_email'], 'email')
+
+
+    def test_update_with_incomplete_response_raises_exception(self):
+        response = {'id': self.id,
+                    'enabled': False,
+                    'pending': True,
+                    'user': self.user
+        }
+        pairing = toopher.Pairing(response, self.api)
+        def fn():
+            pairing._update({'id': self.id, 'pending': True, 'user': self.user})
+        self.assertRaises(toopher.ToopherApiError, fn)
+
+class ddict(dict):
+    def __getitem__(self, key):
+        try:
+            value = super(ddict, self).__getitem__(key)
+            return value
+        except KeyError as e:
+            return ddict()
diff --git a/test/test_toopher_api.py b/test/test_toopher_api.py
new file mode 100644
index 0000000..d92d697
--- /dev/null
+++ b/test/test_toopher_api.py
@@ -0,0 +1,578 @@
+import toopher
+import unittest
+import uuid
+import json
+import pickle
+from .testutils import HttpClientMock
+
+class ToopherApiTests(unittest.TestCase):
+    toopher.DEFAULT_BASE_URL = 'https://api.toopher.test/v1'
+
+    def setUp(self):
+        self.api = toopher.ToopherApi('key', 'secret', 'https://api.toopher.test/v1')
+        self.id = str(uuid.uuid4())
+        self.name = 'name'
+        self.user = {
+            'id': str(uuid.uuid4()),
+            'name': 'user_name',
+            'toopher_authentication_enabled': True
+        }
+        self.user_id = self.user['id']
+        self.user_name = self.user['name']
+        self.reason = 'it is a test'
+        self.reason_code = '0'
+        self.terminal = {
+            'id': str(uuid.uuid4()),
+            'name': 'terminal_name',
+            'requester_specified_id': 'requester_specified_id',
+            'user' : self.user
+        }
+        self.terminal_id = self.terminal['id']
+        self.terminal_name = self.terminal['name']
+        self.requester_specified_id = self.terminal['requester_specified_id']
+        self.action = {
+            'id': str(uuid.uuid4()),
+            'name': 'action_name'
+        }
+        self.action_id = self.action['id']
+        self.action_name = self.action['name']
+
+    def test_constructor(self):
+        def fn():
+            toopher.ToopherApi()
+        self.assertRaises(TypeError, fn)
+
+    def test_version_number_in_library(self):
+        major, minor, patch = toopher.VERSION.split('.')
+        self.assertTrue(int(major) >= 1)
+        self.assertTrue(int(minor) >= 0)
+        self.assertTrue(int(patch) >= 0)
+
+    def test_version_number_in_setup(self):
+        ''' Ensure that the setup.py file has the same version number as the toopher/__init__.py file '''
+        for line in open('setup.py'):
+            if 'version' in line:
+                # in setup.py the version is written as "version='1.0.6'," so we need to remove version=' and ',
+                version_number = line.strip().replace("version='", "").replace("',", "")
+                self.assertEqual(version_number, toopher.VERSION)
+
+    def test_create_user(self):
+        self.api.advanced.raw.client = HttpClientMock({
+            'users/create': (200,
+                json.dumps({
+                    'id': self.id,
+                    'name': self.name,
+                    'toopher_authentication_enabled': True
+                })
+            )
+        })
+        user = self.api.advanced.users.create(self.name)
+        self.assertEqual(self.api.advanced.raw.client.last_called_method, 'POST')
+        self.assertEqual(user.id, self.id)
+        self.assertEqual(user.name, self.name)
+        self.assertTrue(user.toopher_authentication_enabled)
+
+    def test_get_user_by_id(self):
+        self.api.advanced.raw.client = HttpClientMock({
+            'users/{0}'.format(self.id): (200,
+                json.dumps({
+                    'id': self.id,
+                    'name': self.name,
+                    'toopher_authentication_enabled': True
+                })
+            )
+        })
+        user = self.api.advanced.users.get_by_id(self.id)
+        self.assertEqual(self.api.advanced.raw.client.last_called_method, 'GET')
+        self.assertEqual(user.id, self.id)
+        self.assertEqual(user.name, self.name)
+        self.assertTrue(user.toopher_authentication_enabled)
+
+    def test_get_user_by_name(self):
+        self.api.advanced.raw.client = HttpClientMock({
+            'users': (200,
+                json.dumps([{
+                    'id': self.user_id,
+                    'name': self.user_name,
+                    'toopher_authentication_enabled': True
+                }])
+            )
+        })
+        user = self.api.advanced.users.get_by_name(self.user_name)
+        self.assertEqual(self.api.advanced.raw.client.last_called_method, 'GET')
+        self.assertEqual(user.id, self.user_id)
+        self.assertEqual(user.name, self.user_name)
+        self.assertTrue(user.toopher_authentication_enabled)
+
+    def test_get_multiple_users_by_name_raises_error(self):
+        self.api.advanced.raw.client = HttpClientMock({
+            'users': (200,
+                json.dumps([{
+                    'id': self.user_id,
+                    'name': self.user_name,
+                    'toopher_authentication_enabled': True
+                }, {
+                    'id': '2',
+                    'name': self.user_name,
+                    'toopher_authentication_enabled': True
+                }])
+            )
+        })
+
+        def fn():
+            self.api.advanced.users.get_by_name(self.user_name)
+        self.assertRaises(toopher.ToopherApiError, fn)
+
+    def test_get_user_by_name_does_not_exist_raises_error(self):
+        self.api.advanced.raw.client = HttpClientMock({
+            'users': (200, '[]')
+        })
+
+        def fn():
+            self.api.advanced.users.get_by_name(self.user_name)
+        self.assertRaises(toopher.ToopherApiError, fn)
+
+    def test_create_pairing(self):
+        self.api.advanced.raw.client = HttpClientMock({
+            'pairings/create': (200,
+                json.dumps({
+                    'id': self.id,
+                    'enabled': True,
+                    'pending': True,
+                    'user': self.user
+                })
+            )
+        })
+        self.api.pair(self.user_name, 'awkward turtle')
+        self.assertEqual(self.api.advanced.raw.client.last_called_method, 'POST')
+        self.assertEqual(self.api.advanced.raw.client.last_called_data['pairing_phrase'], 'awkward turtle')
+
+        def fn():
+            self.assertEqual(self.api.advanced.raw.client.last_called_data['test_param'], ['42'])
+        self.assertRaises(KeyError, fn)
+
+    def test_pairing(self):
+        self.api.advanced.raw.client = HttpClientMock({
+            'pairings/{0}'.format(self.id): (200,
+                json.dumps({
+                    'id': self.id,
+                    'enabled': True,
+                    'pending': True,
+                    'user': self.user
+                })
+            )
+        })
+        pairing = self.api.advanced.pairings.get_by_id(self.id)
+        self.assertEqual(self.api.advanced.raw.client.last_called_method, 'GET')
+        self.assertEqual(pairing.id, self.id)
+        self.assertEqual(pairing.user.name, self.user_name)
+        self.assertEqual(pairing.user.id, self.user_id)
+        self.assertTrue(pairing.user.toopher_authentication_enabled)
+        self.assertTrue(pairing.enabled)
+        self.assertTrue(pairing.pending)
+
+        def fn():
+            pairing.random_key
+        self.assertRaises(AttributeError, fn)
+
+    def test_create_authentication_request(self):
+        self.api.advanced.raw.client = HttpClientMock({
+            'authentication_requests/initiate': (200,
+                json.dumps({
+                    'id': self.id,
+                    'pending': False,
+                    'granted': True,
+                    'automated': False,
+                    'reason': self.reason,
+                    'reason_code': self.reason_code,
+                    'terminal': self.terminal,
+                    'user': self.user,
+                    'action': self.action
+                })
+            )
+        })
+        self.api.authenticate(self.id, self.terminal_name)
+        self.assertEqual(self.api.advanced.raw.client.last_called_method, 'POST')
+        self.assertEqual(self.api.advanced.raw.client.last_called_data['pairing_id'], self.id)
+        self.assertEqual(self.api.advanced.raw.client.last_called_data['terminal_name'], self.terminal_name)
+
+        def fn():
+            self.assertEqual(self.api.advanced.raw.client.last_called_data['test_param'], '42')
+        self.assertRaises(KeyError, fn)
+
+        self.api.authenticate(self.id, self.terminal_name, action_name=self.action_name)
+        last_called_data = self.api.advanced.raw.client.last_called_data
+        self.assertEqual(self.api.advanced.raw.client.last_called_method, 'POST')
+        self.assertEqual(last_called_data['pairing_id'], self.id)
+        self.assertEqual(last_called_data['terminal_name'], self.terminal_name)
+        self.assertEqual(last_called_data['action_name'], self.action_name)
+
+    def test_get_authentication_request_by_id(self):
+        self.api.advanced.raw.client = HttpClientMock({
+            'authentication_requests/{0}'.format(self.id): (200,
+                json.dumps({
+                    'id': self.id,
+                    'pending': False,
+                    'granted': True,
+                    'automated': False,
+                    'reason': self.reason,
+                    'reason_code': self.reason_code,
+                    'terminal': self.terminal,
+                    'user': self.user,
+                    'action': self.action
+                })
+            )
+        })
+        auth_request = self.api.advanced.authentication_requests.get_by_id(self.id)
+        self.assertEqual(self.api.advanced.raw.client.last_called_method, 'GET')
+        self.assertEqual(auth_request.id, self.id)
+        self.assertFalse(auth_request.pending)
+        self.assertTrue(auth_request.granted)
+        self.assertFalse(auth_request.automated)
+        self.assertEqual(auth_request.reason, self.reason)
+        self.assertEqual(auth_request.reason_code, self.reason_code)
+        self.assertEqual(auth_request.terminal.id, self.terminal_id)
+        self.assertEqual(auth_request.terminal.name, self.terminal_name)
+        self.assertEqual(auth_request.action.id, self.action_id)
+        self.assertEqual(auth_request.action.name, self.action_name)
+
+        def fn():
+            auth_request.random_key
+        self.assertRaises(AttributeError, fn)
+
+    def test_pass_arbitrary_parameters_on_pair(self):
+        self.api.advanced.raw.client = HttpClientMock({
+            'pairings/create': (200,
+                json.dumps({
+                    'id': self.id,
+                    'enabled': True,
+                    'pending': True,
+                    'user': self.user
+                })
+            )
+        })
+        self.api.pair(self.user_name, 'awkward turtle', test_param='42')
+        self.assertEqual(self.api.advanced.raw.client.last_called_method, 'POST')
+        self.assertEqual(self.api.advanced.raw.client.last_called_data['pairing_phrase'], 'awkward turtle')
+        self.assertEqual(self.api.advanced.raw.client.last_called_data['test_param'], '42')
+
+    def test_pass_arbitrary_parameters_on_authenticate(self):
+        self.api.advanced.raw.client = HttpClientMock({
+            'authentication_requests/initiate': (200,
+                json.dumps({
+                    'id': self.id,
+                    'pending': False,
+                    'granted': True,
+                    'automated': False,
+                    'reason': self.reason,
+                    'reason_code': self.reason_code,
+                    'terminal': self.terminal,
+                    'user': self.user,
+                    'action': self.action
+                })
+            )
+        })
+        self.api.authenticate(self.id, self.terminal_name, test_param='42')
+        self.assertEqual(self.api.advanced.raw.client.last_called_method, 'POST')
+        self.assertEqual(self.api.advanced.raw.client.last_called_data['pairing_id'], self.id)
+        self.assertEqual(self.api.advanced.raw.client.last_called_data['terminal_name'], self.terminal_name)
+        self.assertEqual(self.api.advanced.raw.client.last_called_data['test_param'], '42')
+
+    def test_access_arbitrary_keys_in_pairing(self):
+        self.api.advanced.raw.client = HttpClientMock({
+            'pairings/{0}'.format(self.id): (200,
+                json.dumps({
+                    'id': self.id,
+                    'enabled': True,
+                    'pending': True,
+                    'user': self.user,
+                    'random_key': '84'
+                })
+            )
+        })
+        pairing = self.api.advanced.pairings.get_by_id(self.id)
+        self.assertEqual(self.api.advanced.raw.client.last_called_method, 'GET')
+        self.assertEqual(pairing.id, self.id)
+        self.assertEqual(pairing.user.name, self.user_name)
+        self.assertEqual(pairing.user.id, self.user_id)
+        self.assertTrue(pairing.user.toopher_authentication_enabled)
+        self.assertTrue(pairing.enabled)
+        self.assertEqual(pairing.random_key, '84')
+
+    def test_access_arbitrary_keys_in_authentication_request(self):
+        self.api.advanced.raw.client = HttpClientMock({
+            'authentication_requests/{0}'.format(self.id): (200,
+                json.dumps({
+                    'id': self.id,
+                    'pending': False,
+                    'granted': True,
+                    'automated': False,
+                    'reason': self.reason,
+                    'reason_code': self.reason_code,
+                    'terminal': self.terminal,
+                    'user': self.user,
+                    'action': self.action,
+                    'random_key': '84'
+                })
+            )
+        })
+        auth_request = self.api.advanced.authentication_requests.get_by_id(self.id)
+        self.assertEqual(self.api.advanced.raw.client.last_called_method, 'GET')
+        self.assertEqual(auth_request.id, self.id)
+        self.assertFalse(auth_request.pending)
+        self.assertTrue(auth_request.granted)
+        self.assertFalse(auth_request.automated)
+        self.assertEqual(auth_request.reason, self.reason)
+        self.assertEqual(auth_request.reason_code, self.reason_code)
+        self.assertEqual(auth_request.terminal.id, self.terminal_id)
+        self.assertEqual(auth_request.terminal.name, self.terminal_name)
+        self.assertEqual(auth_request.user.id, self.user_id)
+        self.assertEqual(auth_request.user.name, self.user_name)
+        self.assertEqual(auth_request.action.id, self.action_id)
+        self.assertEqual(auth_request.action.name, self.action_name)
+        self.assertEqual(auth_request.random_key, '84')
+
+    def test_pair_qr(self):
+        self.api.advanced.raw.client = HttpClientMock({
+            'pairings/create/qr': (200,
+                json.dumps({
+                    'id': 'id',
+                    'enabled': True,
+                    'pending': True,
+                    'user': self.user
+                })
+            )
+        })
+        self.api.pair(self.user_name)
+        self.assertEqual(self.api.advanced.raw.client.last_called_method, 'POST')
+        self.assertEqual(self.api.advanced.raw.client.last_called_data['user_name'], self.user_name)
+
+    def test_pair_sms(self):
+        self.api.advanced.raw.client = HttpClientMock({
+            'pairings/create/sms': (200,
+                json.dumps({
+                    'id': self.id,
+                    'enabled': True,
+                    'pending': True,
+                    'user': self.user
+                })
+            )
+        })
+        self.api.pair(self.user_name, '555-555-5555')
+        last_called_data = self.api.advanced.raw.client.last_called_data
+        self.assertEqual(self.api.advanced.raw.client.last_called_method, 'POST')
+        self.assertEqual(last_called_data['phone_number'], '555-555-5555')
+        self.assertEqual(last_called_data['user_name'], self.user_name)
+
+        self.api.pair(self.user_name, '555-555-5555', phone_country='1')
+        last_called_data = self.api.advanced.raw.client.last_called_data
+        self.assertEqual(self.api.advanced.raw.client.last_called_method, 'POST')
+        self.assertEqual(last_called_data['phone_number'], '555-555-5555')
+        self.assertEqual(last_called_data['user_name'], self.user_name)
+        self.assertEqual(last_called_data['phone_country'], '1')
+
+    def test_bad_response_raises_correct_error(self):
+        self.api.advanced.raw.client = HttpClientMock({
+            'authentication_requests/initiate': (200,
+                'lol if you think this is json')})
+
+        def fn():
+            self.api.authenticate(self.user_name, requester_specified_id=self.requester_specified_id)
+        self.assertRaises(toopher.ToopherApiError, fn)
+
+    def test_unrecognized_error_still_raises_error(self):
+        self.api.advanced.raw.client = HttpClientMock({
+            'authentication_requests/initiate': (409,
+                json.dumps({
+                    'error_code': 42,
+                    'error_message': 'what'
+                })
+            )
+        })
+
+        def fn():
+            self.api.authenticate(self.user_name, requester_specified_id=self.requester_specified_id)
+        self.assertRaises(toopher.ToopherApiError, fn)
+
+    def test_create_user_terminal(self):
+        self.api.advanced.raw.client = HttpClientMock({
+            'user_terminals/create': (200,
+                json.dumps({
+                    'id': self.id,
+                    'name': self.terminal_name,
+                    'requester_specified_id': self.requester_specified_id,
+                    'user': self.user
+                })
+            )
+        })
+        user_terminal = self.api.advanced.user_terminals.create(self.user_name, self.terminal_name, self.requester_specified_id)
+        self.assertEqual(self.api.advanced.raw.client.last_called_method, 'POST')
+        self.assertEqual(user_terminal.id, self.id)
+        self.assertEqual(user_terminal.user.name, self.user_name)
+        self.assertEqual(user_terminal.user.id, self.user_id)
+        self.assertEqual(user_terminal.name, self.terminal_name)
+        self.assertEqual(user_terminal.requester_specified_id, self.requester_specified_id)
+
+    def test_get_user_terminal_by_id(self):
+        self.api.advanced.raw.client = HttpClientMock({
+            'user_terminals/{0}'.format(self.id): (200,
+                json.dumps({
+                    'id': self.id,
+                    'name': self.terminal_name,
+                    'requester_specified_id': self.requester_specified_id,
+                    'user': self.user
+                })
+            )
+        })
+        user_terminal = self.api.advanced.user_terminals.get_by_id(self.id)
+        self.assertEqual(self.api.advanced.raw.client.last_called_method, 'GET')
+        self.assertEqual(user_terminal.id, self.id)
+        self.assertEqual(user_terminal.name, self.terminal_name)
+        self.assertEqual(user_terminal.requester_specified_id, self.requester_specified_id)
+        self.assertEqual(user_terminal.user.name, self.user_name)
+        self.assertEqual(user_terminal.user.id, self.user_id)
+
+    def test_action_missing_id_raises_error(self):
+        data = self.action
+        del data['id']
+        def fn():
+            toopher.Action(data)
+        self.assertRaises(toopher.ToopherApiError, fn)
+
+    def test_action_update_missing_name_raises_error(self):
+        action = toopher.Action(self.action)
+        def fn():
+            action._update({'id':'1'})
+        self.assertRaises(toopher.ToopherApiError, fn)
+
+    def test_raw_get(self):
+        self.api.advanced.raw.client = HttpClientMock({
+            'pairings/{0}'.format(self.id): (200,
+                json.dumps({
+                    'id': self.id,
+                    'enabled': True,
+                    'user': self.user
+                })
+            )
+        })
+        result = self.api.advanced.raw.get('/pairings/{0}'.format(self.id))
+        self.assertEqual(self.api.advanced.raw.client.last_called_method, 'GET')
+        self.assertEqual(result['id'], self.id)
+        self.assertEqual(result['user']['name'], self.user_name)
+        self.assertEqual(result['user']['id'], self.user_id)
+        self.assertTrue(result['enabled'])
+
+    def test_raw_post(self):
+        self.api.advanced.raw.client = HttpClientMock({
+            'user_terminals/create': (200,
+                json.dumps({
+                  'id': self.id,
+                  'name': self.terminal_name,
+                  'requester_specified_id': self.requester_specified_id,
+                  'user': self.user
+                })
+            )
+        })
+        result = self.api.advanced.raw.post('/user_terminals/create',
+                               name='terminal_name',
+                               requester_specified_id='requester_specified_id',
+                               user_name='user_name')
+        self.assertEqual(self.api.advanced.raw.client.last_called_method, 'POST')
+        self.assertEqual(result['id'], self.id)
+        self.assertEqual(result['user']['name'], self.user_name)
+        self.assertEqual(result['user']['id'], self.user_id)
+        self.assertEqual(result['name'], self.terminal_name)
+        self.assertEqual(result['requester_specified_id'], self.requester_specified_id)
+
+    def test_disabled_user_raises_correct_error(self):
+        self.api.advanced.raw.client = HttpClientMock({
+            'authentication_requests/initiate': (409,
+                json.dumps({
+                    'error_code': 704,
+                    'error_message': 'disabled user'
+                })
+            )
+        })
+
+        def fn():
+            self.api.authenticate('disabled user', 'terminal name')
+        self.assertRaises(toopher.UserDisabledError, fn)
+
+    def test_unknown_user_raises_correct_error(self):
+        self.api.advanced.raw.client = HttpClientMock({
+            'authentication_requests/initiate': (409,
+                json.dumps({
+                    'error_code': 705,
+                    'error_message': 'unknown user'
+                })
+            )
+        })
+
+        def fn():
+            self.api.authenticate('unknown user', 'terminal name')
+        self.assertRaises(toopher.UserUnknownError, fn)
+
+    def test_unknown_terminal_raises_correct_error(self):
+        self.api.advanced.raw.client = HttpClientMock({
+            'authentication_requests/initiate': (409,
+                json.dumps({
+                    'error_code': 706,
+                    'error_message': 'unknown terminal'
+                })
+            )
+        })
+
+        def fn():
+            self.api.authenticate(self.user_name, 'unknown terminal name')
+        self.assertRaises(toopher.TerminalUnknownError, fn)
+
+    def test_deactivated_pairing_raises_correct_error(self):
+        self.api.advanced.raw.client = HttpClientMock({
+            'authentication_requests/initiate': (409,
+                json.dumps({
+                    'error_code': 707,
+                    'error_message': 'Pairing has been deactivated'
+                })
+            )
+        })
+
+        def fn():
+            self.api.authenticate(self.user_name, requester_specified_id=self.requester_specified_id)
+        self.assertRaises(toopher.PairingDeactivatedError, fn)
+
+    def test_unauthorized_pairing_raises_correct_error(self):
+        self.api.advanced.raw.client = HttpClientMock({
+            'authentication_requests/initiate': (409,
+                json.dumps({
+                    'error_code': 601,
+                    'error_message': 'Pairing has not been authorized'
+                })
+            )
+        })
+
+        def fn():
+            self.api.authenticate(self.user_name, requester_specified_id=self.requester_specified_id)
+        self.assertRaises(toopher.PairingDeactivatedError, fn)
+
+
+class ToopherBaseTests(unittest.TestCase):
+    def test_pickling_and_unpickling(self):
+        response = {
+            'id': str(uuid.uuid4()),
+            'enabled': True,
+            'pending': True,
+            'user': {
+                'id': str(uuid.uuid4()),
+                'name': 'user_name',
+                'toopher_authentication_enabled': True
+            }
+        }
+        pairing = toopher.Pairing(response, toopher.ToopherApi('key', 'secret'))
+        pickled_pairing = pickle.loads(pickle.dumps(pairing))
+
+        self.assertEqual(pairing.id, pickled_pairing.id)
+        self.assertEqual(pairing.user.id, pickled_pairing.user.id)
+        self.assertEqual(pairing.user.name, pickled_pairing.user.name)
+        self.assertTrue(pickled_pairing.enabled)
+        self.assertTrue(pickled_pairing.pending)
+        self.assertEqual(dir(pairing), dir(pickled_pairing))
diff --git a/test/test_toopher_iframe.py b/test/test_toopher_iframe.py
new file mode 100644
index 0000000..905d213
--- /dev/null
+++ b/test/test_toopher_iframe.py
@@ -0,0 +1,321 @@
+import unittest
+import time
+import urllib
+import toopher
+import logging
+
+class ToopherIframeTests(unittest.TestCase):
+    logging.disable(logging.CRITICAL)
+
+    toopher.DEFAULT_BASE_URL = 'https://api.toopher.test/v1'
+
+    request_token = 's9s7vsb'
+
+    def setUp(self):
+        self.iframe_api = toopher.ToopherIframe('abcdefg', 'hijklmnop', 'https://api.toopher.test/v1')
+        self.iframe_api.client.nonce = '12345678'
+        self.old_time = time.time
+        time.time = lambda: 1000
+
+    def tearDown(self):
+        time.time = self.old_time
+
+    def _get_auth_request_postback_data_as_dict(self):
+        return {
+            'id': '1',
+            'pending': 'false',
+            'granted': 'true',
+            'automated': 'false',
+            'reason': 'it is a test',
+            'reason_code': '100',
+            'terminal_id': '1',
+            'terminal_name': 'terminal name',
+            'terminal_requester_specified_id': 'requester specified id',
+            'pairing_user_id': '1',
+            'user_name': 'user name',
+            'user_toopher_authentication_enabled': 'true',
+            'action_id': '1',
+            'action_name': 'action name',
+            'toopher_sig': 's+fYUtChrNMjES5Xa+755H7BQKE=',
+            'session_token': ToopherIframeTests.request_token,
+            'timestamp': '1000',
+            'resource_type': 'authentication_request'
+        }
+
+    def _get_urlencoded_auth_request_postback_data(self, auth_request_data = None):
+        data = auth_request_data if auth_request_data else self._get_auth_request_postback_data_as_dict()
+        return urllib.urlencode(data)
+
+    def _get_pairing_postback_data_as_dict(self):
+        return {
+            'id': '1',
+            'enabled': 'true',
+            'pending': 'false',
+            'pairing_user_id': '1',
+            'user_name': 'user name',
+            'user_toopher_authentication_enabled': 'true',
+            'toopher_sig': 'ucwKhkPpN4VxNbx3dMypWzi4tBg=',
+            'session_token': ToopherIframeTests.request_token,
+            'timestamp': '1000',
+            'resource_type': 'pairing'
+        }
+
+    def _get_urlencoded_pairing_postback_data(self, pairing_data=None):
+        data = pairing_data if pairing_data else self._get_pairing_postback_data_as_dict()
+        return urllib.urlencode(data)
+
+    def _get_user_postback_data_as_dict(self):
+        return {
+            'id': '1',
+            'name': 'user name',
+            'toopher_authentication_enabled': 'true',
+            'toopher_sig': 'RszgG9QE1rF9t7DVTGg+1I25yHM=',
+            'session_token': ToopherIframeTests.request_token,
+            'timestamp': '1000',
+            'resource_type': 'requester_user'
+        }
+
+    def _get_urlencoded_user_postback_data(self, user_data=None):
+        data = user_data if user_data else self._get_user_postback_data_as_dict()
+        return urllib.urlencode(data)
+
+    def test_process_postback_good_signature_returns_authentication_request(self):
+        auth_data = self._get_auth_request_postback_data_as_dict()
+        auth_request = self.iframe_api.process_postback(self._get_urlencoded_auth_request_postback_data(auth_data), ToopherIframeTests.request_token)
+        self.assertEqual(type(auth_request), toopher.AuthenticationRequest)
+        self.assertEqual(auth_request.id, auth_data.get('id'))
+        self.assertFalse(auth_request.pending)
+        self.assertTrue(auth_request.granted)
+        self.assertFalse(auth_request.automated)
+        self.assertEqual(auth_request.reason, auth_data.get('reason'))
+        self.assertEqual(auth_request.reason_code, auth_data.get('reason_code'))
+        self.assertEqual(auth_request.terminal.id, auth_data.get('terminal_id'))
+        self.assertEqual(auth_request.terminal.name, auth_data.get('terminal_name'))
+        self.assertEqual(auth_request.terminal.requester_specified_id, auth_data.get('terminal_requester_specified_id'))
+        self.assertEqual(auth_request.user.id, auth_data.get('pairing_user_id'))
+        self.assertEqual(auth_request.user.name, auth_data.get('user_name'))
+        self.assertTrue(auth_request.user.toopher_authentication_enabled)
+        self.assertEqual(auth_request.action.id, auth_data.get('action_id'))
+        self.assertEqual(auth_request.action.name, auth_data.get('action_name'))
+
+    def test_process_postback_good_signature_returns_pairing(self):
+        pairing_data = self._get_pairing_postback_data_as_dict()
+        pairing = self.iframe_api.process_postback(self._get_urlencoded_pairing_postback_data(pairing_data), ToopherIframeTests.request_token)
+        self.assertEqual(type(pairing), toopher.Pairing)
+        self.assertEqual(pairing.id, pairing_data.get('id'))
+        self.assertTrue(pairing.enabled)
+        self.assertFalse(pairing.pending)
+        self.assertEqual(pairing.user.id, pairing_data.get('pairing_user_id'))
+        self.assertEqual(pairing.user.name, pairing_data.get('user_name'))
+        self.assertTrue(pairing.user.toopher_authentication_enabled)
+
+    def test_process_postback_good_signature_returns_user(self):
+        user_data = self._get_user_postback_data_as_dict()
+        user = self.iframe_api.process_postback(self._get_urlencoded_user_postback_data(user_data), ToopherIframeTests.request_token)
+        self.assertEqual(type(user), toopher.User)
+        self.assertEqual(user.id, user_data.get('id'))
+        self.assertEqual(user.name, user_data.get('name'))
+        self.assertTrue(user.toopher_authentication_enabled)
+
+    def test_process_postback_good_signature_with_extras_returns_authentication_request(self):
+        auth_request = self.iframe_api.process_postback(self._get_urlencoded_auth_request_postback_data(), ToopherIframeTests.request_token, ttl=100)
+        self.assertEqual(type(auth_request), toopher.AuthenticationRequest)
+
+    def test_process_postback_good_signature_without_request_token_returns_authentication_request(self):
+        auth_request = self.iframe_api.process_postback(self._get_urlencoded_auth_request_postback_data())
+        self.assertEqual(type(auth_request), toopher.AuthenticationRequest)
+
+    def test_process_postback_with_key_with_empty_value_returns_authentication_request(self):
+        auth_data = self._get_auth_request_postback_data_as_dict()
+        auth_data['requester_metadata'] = ''
+        auth_data['toopher_sig'] = '2CQouLu8dL3OA8N/mgHK6eeYHm4='
+        auth_request = self.iframe_api.process_postback(urllib.urlencode(auth_data))
+        self.assertEqual(type(auth_request), toopher.AuthenticationRequest)
+
+    def test_process_postback_bad_signature_fails(self):
+        data = self._get_auth_request_postback_data_as_dict()
+        data['toopher_sig'] = 'invalid'
+        try:
+            self.iframe_api.process_postback(self._get_urlencoded_auth_request_postback_data(data), ToopherIframeTests.request_token)
+            self.fail('SignatureValidationError was not raised for bad signature')
+        except toopher.SignatureValidationError as e:
+            self.assertEqual(e.message, 'Computed signature does not match submitted signature: {0} vs {1}'.format(self._get_auth_request_postback_data_as_dict()['toopher_sig'], data['toopher_sig']))
+
+    def test_process_postback_expired_signature_fails(self):
+        data = self._get_urlencoded_auth_request_postback_data()
+        time.time = lambda: 2000
+        try:
+            self.iframe_api.process_postback(data, ToopherIframeTests.request_token)
+            self.fail('SignatureValidationError was not raised for expired signature')
+        except toopher.SignatureValidationError as e:
+            self.assertEqual(e.message, 'TTL expired')
+
+    def test_process_postback_missing_signature_fails(self):
+        data = self._get_auth_request_postback_data_as_dict()
+        del data['toopher_sig']
+        try:
+            self.iframe_api.process_postback(self._get_urlencoded_auth_request_postback_data(data), ToopherIframeTests.request_token)
+            self.fail('SignatureValidationError was not raised for missing toopher_sig')
+        except toopher.SignatureValidationError as e:
+            self.assertEqual(e.message, 'Missing required keys: toopher_sig')
+
+    def test_process_postback_missing_timestamp_fails(self):
+        data = self._get_auth_request_postback_data_as_dict()
+        del data['timestamp']
+        try:
+            self.iframe_api.process_postback(self._get_urlencoded_auth_request_postback_data(data), ToopherIframeTests.request_token)
+            self.fail('SignatureValidationError was not raised for missing timestamp')
+        except toopher.SignatureValidationError as e:
+            self.assertEqual(e.message, 'Missing required keys: timestamp')
+
+    def test_process_postback_missing_session_token_fails(self):
+        data = self._get_auth_request_postback_data_as_dict()
+        del data['session_token']
+        try:
+            self.iframe_api.process_postback(self._get_urlencoded_auth_request_postback_data(data), ToopherIframeTests.request_token)
+            self.fail('SignatureValidationError was not raised for missing session_token')
+        except toopher.SignatureValidationError as e:
+            self.assertEqual(e.message, 'Missing required keys: session_token')
+
+    def test_process_postback_invalid_session_token_fails(self):
+        data = self._get_auth_request_postback_data_as_dict()
+        data['session_token'] = 'invalid token'
+        try:
+            self.iframe_api.process_postback(self._get_urlencoded_auth_request_postback_data(data), ToopherIframeTests.request_token)
+            self.fail('SignatureValidationError was not raised for invalid session_token')
+        except toopher.SignatureValidationError as e:
+            self.assertEqual(e.message, 'Session token does not match expected value!')
+
+    def test_process_postback_bad_resource_type_raises_error(self):
+        data = self._get_auth_request_postback_data_as_dict()
+        data['resource_type'] = 'invalid'
+        data['toopher_sig'] = 'xEY+oOtJcdMsmTLp6eOy9isO/xQ='
+        try:
+            self.iframe_api.process_postback(self._get_urlencoded_auth_request_postback_data(data), ToopherIframeTests.request_token)
+            self.fail('ToopherApiError was not raise for invalid postback resource type')
+        except toopher.ToopherApiError as e:
+            self.assertEqual(e.message, 'The postback resource type is not valid: invalid')
+
+    def test_process_postback_with_704_fails(self):
+        data = self._get_auth_request_postback_data_as_dict()
+        data['error_code'] = 704
+        data['error_message'] = 'The specified user has disabled Toopher authentication.'
+        try:
+            self.iframe_api.process_postback(self._get_urlencoded_auth_request_postback_data(data), ToopherIframeTests.request_token)
+            self.fail('UserDisabledError was not raised for error code 704')
+        except toopher.UserDisabledError as e:
+            self.assertEqual(e.message, 'The specified user has disabled Toopher authentication.')
+
+    def test_process_postback_with_bad_secret_raises_error(self):
+        iframe_api = toopher.ToopherIframe('abcdefg', 1, 'https://api.toopher.test/v1')
+        try:
+            iframe_api.process_postback(self._get_urlencoded_auth_request_postback_data(), ToopherIframeTests.request_token)
+            self.fail('SignatureValidationError was not raised while calculating signature with bad secret')
+        except toopher.SignatureValidationError as e:
+            self.assertEqual(e.message, "Error while calculating signature: 'int' object has no attribute 'encode'")
+
+    def test_is_authentication_granted_is_true_with_auth_request_granted(self):
+        data = self._get_urlencoded_auth_request_postback_data()
+        authentication_granted = self.iframe_api.is_authentication_granted(data, ToopherIframeTests.request_token)
+        self.assertTrue(authentication_granted, 'Authentication should be granted with '
+                                                'AuthenticationRequest.granted = True')
+
+    def test_is_authentication_granted_is_true_with_request_request_granted_and_extras(self):
+        data = self._get_urlencoded_auth_request_postback_data()
+        authentication_granted = self.iframe_api.is_authentication_granted(data, ToopherIframeTests.request_token, ttl=100)
+        self.assertTrue(authentication_granted, 'Authentication should be granted with '
+                                                'AuthenticationRequest.granted = True and extras')
+
+    def test_is_authentication_granted_is_true_with_auth_request_granted_without_request_token(self):
+        data = self._get_urlencoded_auth_request_postback_data()
+        authentication_granted = self.iframe_api.is_authentication_granted(data)
+        self.assertTrue(authentication_granted, 'Authentication should be granted with '
+                                                'AuthenticationRequest.granted = True and without request token')
+
+    def test_is_authentication_granted_is_false_with_auth_request_not_granted(self):
+        data = self._get_auth_request_postback_data_as_dict()
+        data['granted'] = 'false'
+        data['toopher_sig'] = 'nADNKdly9zA2IpczD6gvDumM48I='
+        authentication_granted = self.iframe_api.is_authentication_granted(self._get_urlencoded_auth_request_postback_data(data), self.request_token)
+        self.assertFalse(authentication_granted, 'Authentication should not be granted with '
+                                                 'AuthenticationRequest.granted = False')
+
+    def test_is_authentication_granted_is_false_with_auth_request_granted_and_pending_true(self):
+        data = self._get_auth_request_postback_data_as_dict()
+        data['granted'] = 'true'
+        data['pending'] = 'true'
+        data['toopher_sig'] = 'vmWBQCy8Py5PVkMZRppbCG7cm0w='
+        authentication_granted = self.iframe_api.is_authentication_granted(self._get_urlencoded_auth_request_postback_data(data), self.request_token)
+        self.assertFalse(authentication_granted, 'Authentication should not be granted with '
+                                                 'AuthenticationRequest.granted = True and pending = True')
+
+    def test_is_authentication_granted_returns_false_when_pairing_is_returned(self):
+        authentication_granted = self.iframe_api.is_authentication_granted(self._get_urlencoded_pairing_postback_data(), self.request_token)
+        self.assertFalse(authentication_granted, 'Authentication should not be granted when Pairing is returned')
+
+    def test_is_authentication_granted_returns_false_when_user_is_returned(self):
+        authentication_granted = self.iframe_api.is_authentication_granted(self._get_urlencoded_user_postback_data(), self.request_token)
+        self.assertFalse(authentication_granted, 'Authentication should not be granted when User is returned')
+
+    def test_is_authentication_granted_returns_false_when_signature_validation_error_is_raised(self):
+        data = self._get_auth_request_postback_data_as_dict()
+        del data['id']
+        authentication_granted = self.iframe_api.is_authentication_granted(self._get_urlencoded_auth_request_postback_data(data), self.request_token)
+        self.assertFalse(authentication_granted, 'Authentication should not be granted when '
+                                                 'SignatureValidationError is raised')
+
+    def test_is_authentication_granted_returns_false_when_toopher_api_error_is_raised(self):
+        data = self._get_auth_request_postback_data_as_dict()
+        data['resource_type'] = 'invalid'
+        data['toopher_sig'] = 'xEY+oOtJcdMsmTLp6eOy9isO/xQ='
+        authentication_granted = self.iframe_api.is_authentication_granted(self._get_urlencoded_auth_request_postback_data(data), self.request_token)
+        self.assertFalse(authentication_granted, 'Authentication should not be granted when ToopherApiError is raised')
+
+    def test_is_authentication_granted_returns_true_when_user_disabled_error_is_raised(self):
+        data = self._get_auth_request_postback_data_as_dict()
+        data['error_code'] = 704
+        data['error_message'] = 'The specified user has disabled Toopher authentication.'
+        authentication_granted = self.iframe_api.is_authentication_granted(self._get_urlencoded_auth_request_postback_data(data), self.request_token)
+        self.assertTrue(authentication_granted, 'Authentication should be granted when UserDisabledError '
+                                                'is raised')
+
+    def test_get_user_management_url_only_username(self):
+        expected = 'https://api.toopher.test/v1/web/manage_user?username=jdoe&reset_email=&expires=1300&v=2&oauth_nonce=12345678&oauth_timestamp=1000&oauth_version=1.0&oauth_signature_method=HMAC-SHA1&oauth_consumer_key=abcdefg&oauth_signature=SA7CAUj%2B5QcGO%2BMmdPv9ubbaozk%3D'
+        self.assertEqual(expected, self.iframe_api.get_user_management_url('jdoe'))
+
+    def test_get_user_management_url_with_email_and_extras(self):
+        expected = 'https://api.toopher.test/v1/web/manage_user?username=jdoe&reset_email=jdoe%40example.com&expires=1100&v=2&oauth_nonce=12345678&oauth_timestamp=1000&oauth_version=1.0&oauth_signature_method=HMAC-SHA1&oauth_consumer_key=abcdefg&oauth_signature=sV8qoKnxJ3fxfP6AHNa0eNFxzJs%3D'
+        self.assertEqual(expected, self.iframe_api.get_user_management_url('jdoe', 'jdoe@example.com', ttl=100))
+
+    def test_get_user_management_url_with_extras(self):
+        expected = 'https://api.toopher.test/v1/web/manage_user?username=jdoe&reset_email=&foo=bar&expires=1100&v=2' \
+                   '&oauth_nonce=12345678&oauth_timestamp=1000&oauth_version=1.0&oauth_signature_method=HMAC-SHA1&oauth_consumer_key=abcdefg&oauth_signature=5DE7uRWNHNb0%2B76yqUuzoDpdjVg%3D'
+        self.assertEqual(expected, self.iframe_api.get_user_management_url('jdoe', ttl=100, foo='bar'))
+
+    def test_get_user_management_url_removes_ttl_from_kwargs(self):
+        expected = 'https://api.toopher.test/v1/web/manage_user?username=jdoe&reset_email=jdoe%40example.com&expires=1500&v=2&oauth_nonce=12345678&oauth_timestamp=1000&oauth_version=1.0&oauth_signature_method=HMAC-SHA1&oauth_consumer_key=abcdefg&oauth_signature=%2BQrbKZH2NDxURKE9Yjb6wxegeAM%3D'
+        url = self.iframe_api.get_user_management_url('jdoe', 'jdoe@example.com', ttl=500)
+        self.assertEqual(expected, url)
+
+    def test_get_authentication_url_only_username(self):
+        expected = 'https://api.toopher.test/v1/web/authenticate?username=jdoe&reset_email=&session_token=&expires=1300&action_name=Log+In&requester_metadata=&v=2&oauth_nonce=12345678&oauth_timestamp=1000&oauth_version=1.0&oauth_signature_method=HMAC-SHA1&oauth_consumer_key=abcdefg&oauth_signature=NkaWUjEPRLwgsQMEJGsIQEpyRT4%3D'
+        url = self.iframe_api.get_authentication_url('jdoe')
+        self.assertEqual(expected, url)
+
+    def test_get_authentication_url_with_optional_args(self):
+        expected = 'https://api.toopher.test/v1/web/authenticate?username=jdoe&reset_email=jdoe%40example.com&session_token=s9s7vsb&expires=1300&action_name=it+is+a+test&requester_metadata=metadata&v=2&oauth_nonce=12345678&oauth_timestamp=1000&oauth_version=1.0&oauth_signature_method=HMAC-SHA1&oauth_consumer_key=abcdefg&oauth_signature=2TydgMnUwWoiwfpljKpSaFg0Luo%3D'
+        self.assertEqual(expected, self.iframe_api.get_authentication_url('jdoe', 'jdoe@example.com', self.request_token, 'it is a test', 'metadata'))
+
+    def test_get_authentication_url_with_optional_args_and_extras(self):
+        expected = 'https://api.toopher.test/v1/web/authenticate?username=jdoe&reset_email=jdoe%40example.com&session_token=s9s7vsb&allow_inline_pairing=False&expires=1100&action_name=it+is+a+test&automation_allowed=False&requester_metadata=metadata&v=2&challenge_required=True&oauth_nonce=12345678&oauth_timestamp=1000&oauth_version=1.0&oauth_signature_method=HMAC-SHA1&oauth_consumer_key=abcdefg&oauth_signature=hKogqI%2FgjKXpYIH%2BjNDhRSi22b4%3D'
+        self.assertEqual(expected, self.iframe_api.get_authentication_url('jdoe', 'jdoe@example.com', self.request_token, 'it is a test', 'metadata', allow_inline_pairing=False, automation_allowed=False, challenge_required=True, ttl=100))
+
+    def test_get_authentication_url_with_extras(self):
+        expected = 'https://api.toopher.test/v1/web/authenticate?username=jdoe&reset_email=&session_token=&allow_inline_pairing=False&expires=1100&action_name=Log+In&automation_allowed=False&requester_metadata=&v=2&challenge_required=True&oauth_nonce=12345678&oauth_timestamp=1000&oauth_version=1.0&oauth_signature_method=HMAC-SHA1&oauth_consumer_key=abcdefg&oauth_signature=Vf0vX4Lbh8GbtfanIQVMo3yL8Rw%3D'
+        self.assertEqual(expected, self.iframe_api.get_authentication_url('jdoe', allow_inline_pairing=False, automation_allowed=False, challenge_required=True, ttl=100))
+
+    def test_get_authentication_url_removes_ttl_from_kwargs(self):
+        expected = 'https://api.toopher.test/v1/web/authenticate?username=jdoe&reset_email=jdoe%40example.com&session_token=&expires=1500&action_name=Log+In&requester_metadata=&v=2&oauth_nonce=12345678&oauth_timestamp=1000&oauth_version=1.0&oauth_signature_method=HMAC-SHA1&oauth_consumer_key=abcdefg&oauth_signature=yEdtdtVDvYZZwoWR19IoxpzSqQU%3D'
+        url = self.iframe_api.get_authentication_url('jdoe', 'jdoe@example.com', ttl=500)
+        self.assertEqual(expected, url)
+
diff --git a/test/test_user.py b/test/test_user.py
new file mode 100644
index 0000000..d8c611a
--- /dev/null
+++ b/test/test_user.py
@@ -0,0 +1,109 @@
+import toopher
+import unittest
+import uuid
+import json
+from .testutils import HttpClientMock
+
+class UserTests(unittest.TestCase):
+    toopher.DEFAULT_BASE_URL = 'https://api.toopher.test/v1'
+
+    def setUp(self):
+        self.api = toopher.ToopherApi('key', 'secret', 'https://api.toopher.test/v1')
+        self.id = str(uuid.uuid4())
+        self.name = 'user_name'
+
+    def test_incomplete_response_raises_exception(self):
+        response = {'key': 'value'}
+        def fn():
+            toopher.User(response, self.api)
+        self.assertRaises(toopher.ToopherApiError, fn)
+
+    def test_refresh_from_server(self):
+        response = {
+            'id': self.id,
+            'name': self.name,
+            'toopher_authentication_enabled': True
+        }
+        user = toopher.User(response, self.api)
+        self.api.advanced.raw.client = HttpClientMock({
+            'users/{0}'.format(user.id): (200,
+                json.dumps({
+                    'id': self.id,
+                    'name': 'name CHANGED',
+                    'toopher_authentication_enabled': False
+                })
+            )
+        })
+        user.refresh_from_server()
+        self.assertEqual(self.api.advanced.raw.client.last_called_method, 'GET')
+        self.assertEqual(user.id, self.id)
+        self.assertEqual(user.name, 'name CHANGED')
+        self.assertFalse(user.toopher_authentication_enabled)
+
+    def test_enable(self):
+        response = {
+            'id': self.id,
+            'name': self.name,
+            'toopher_authentication_enabled': False
+        }
+        user = toopher.User(response, self.api)
+        self.api.advanced.raw.client = HttpClientMock({
+            'users/{0}'.format(user.id): (200,
+                json.dumps({
+                    'id': self.id,
+                    'name': self.name,
+                    'toopher_authentication_enabled': True
+                })
+            )
+        })
+        user.enable_toopher_authentication()
+        self.assertEqual(self.api.advanced.raw.client.last_called_method, 'POST')
+        self.assertTrue(self.api.advanced.raw.client.last_called_data['toopher_authentication_enabled'])
+        self.assertTrue(user.toopher_authentication_enabled)
+
+    def test_disable(self):
+        response = {
+            'id': self.id,
+            'name': self.name,
+            'toopher_authentication_enabled': True
+        }
+        user = toopher.User(response, self.api)
+        self.api.advanced.raw.client = HttpClientMock({
+            'users/{0}'.format(self.id): (200,
+                json.dumps({
+                    'id': self.id,
+                    'name': self.name,
+                    'toopher_authentication_enabled': False
+                })
+            )
+        })
+        user.disable_toopher_authentication()
+        self.assertEqual(self.api.advanced.raw.client.last_called_method, 'POST')
+        self.assertFalse(self.api.advanced.raw.client.last_called_data['toopher_authentication_enabled'])
+        self.assertFalse(user.toopher_authentication_enabled)
+
+    def test_reset(self):
+        response = {
+            'id': self.id,
+            'name': self.name,
+            'toopher_authentication_enabled': True}
+        user = toopher.User(response, self.api)
+        self.api.advanced.raw.client = HttpClientMock({
+            'users/reset': (200,
+                            '[]'
+            )
+        })
+        user.reset()
+        self.assertEqual(self.api.advanced.raw.client.last_called_method, 'POST')
+        self.assertEqual(self.api.advanced.raw.client.last_called_data['user_name'], self.name)
+
+    def test_update_with_incomplete_response_raises_exception(self):
+        response = {
+            'id': self.id,
+            'name': self.name,
+            'toopher_authentication_enabled': True
+        }
+        user = toopher.User(response, self.api)
+        def fn():
+            user._update({'id': self.id, 'toopher_authentication_enabled': True})
+        self.assertRaises(toopher.ToopherApiError, fn)
diff --git a/test/test_user_terminal.py b/test/test_user_terminal.py
new file mode 100644
index 0000000..4f1ceb3
--- /dev/null
+++ b/test/test_user_terminal.py
@@ -0,0 +1,69 @@
+import toopher
+import unittest
+import uuid
+import json
+from .testutils import HttpClientMock
+
+class UserTerminalTests(unittest.TestCase):
+    toopher.DEFAULT_BASE_URL = 'https://api.toopher.test/v1'
+
+    def setUp(self):
+        self.api = toopher.ToopherApi('key', 'secret', 'https://api.toopher.test/v1')
+        self.id = str(uuid.uuid4())
+        self.name = 'name'
+        self.requester_specified_id = 'requester_specified_id'
+        self.user = {
+            'id': str(uuid.uuid4()),
+            'name': 'user_name',
+            'toopher_authentication_enabled': True
+        }
+        self.user_id = self.user['id']
+
+    def test_incomplete_response_raises_exception(self):
+        response = {'key': 'value'}
+        def fn():
+            toopher.UserTerminal(response, self.api)
+        self.assertRaises(toopher.ToopherApiError, fn)
+
+    def test_refresh_from_server(self):
+        response = {
+            'id': self.id,
+            'name': self.name,
+            'requester_specified_id': self.requester_specified_id,
+            'user': self.user
+        }
+        user_terminal = toopher.UserTerminal(response, self.api)
+        self.api.advanced.raw.client = HttpClientMock({
+            'user_terminals/{0}'.format(user_terminal.id): (200,
+                json.dumps({
+                    'id': self.id,
+                    'name': 'name changed',
+                    'requester_specified_id': 'requester_specified_id changed',
+                    'user': {
+                        'id': self.user_id,
+                        'name': 'user_name changed',
+                        'toopher_authentication_enabled': False
+                    }
+                })
+            )
+        })
+        user_terminal.refresh_from_server()
+        self.assertEqual(self.api.advanced.raw.client.last_called_method, 'GET')
+        self.assertEqual(user_terminal.id, self.id)
+        self.assertEqual(user_terminal.name, 'name changed')
+        self.assertEqual(user_terminal.requester_specified_id, 'requester_specified_id changed')
+        self.assertEqual(user_terminal.user.name, 'user_name changed')
+        self.assertEqual(user_terminal.user.id, self.user_id)
+        self.assertFalse(user_terminal.user.toopher_authentication_enabled)
+
+    def test_update_with_incomplete_response_raises_exception(self):
+        response = {
+            'id': self.id,
+            'name': self.name,
+            'requester_specified_id': self.requester_specified_id,
+            'user': self.user
+        }
+        user_terminal = toopher.UserTerminal(response, self.api)
+        def fn():
+            user_terminal._update({'id': self.id, 'requester_specified_id': self.requester_specified_id, 'user': self.user})
+        self.assertRaises(toopher.ToopherApiError, fn)
\ No newline at end of file
diff --git a/test/testutils.py b/test/testutils.py
new file mode 100644
index 0000000..da7c9f5
--- /dev/null
+++ b/test/testutils.py
@@ -0,0 +1,22 @@
+import toopher
+import requests
+
+class HttpClientMock(object):
+    def __init__(self, paths):
+        self.paths = paths
+
+    def request(self, method, uri, data=None, headers=None, params=None):
+        self.last_called_uri = uri
+        self.last_called_method = method
+        self.last_called_data = data if data else params
+        self.last_called_headers = headers
+
+        uri = uri.split(toopher.DEFAULT_BASE_URL)[1][1:]
+        return ResponseMock(self.paths[uri])
+
+
+class ResponseMock(requests.Response):
+    def __init__(self, response):
+        self.encoding = 'utf-8'
+        self.status_code = int(response[0])
+        self._content = response[1]
\ No newline at end of file
diff --git a/tests.py b/tests.py
deleted file mode 100644
index c849a51..0000000
--- a/tests.py
+++ /dev/null
@@ -1,477 +0,0 @@
-import json
-import toopher
-import requests
-import unittest
-import time
-import werkzeug.datastructures
-
-class HttpClientMock(object):
-    def __init__(self, paths):
-        self.paths = paths
-
-    def request(self, method, uri, data=None, headers=None, params=None):
-        self.last_called_uri = uri
-        self.last_called_method = method
-        self.last_called_data = data if data else params
-        self.last_called_headers = headers
-
-        uri = uri.split(toopher.DEFAULT_BASE_URL)[1][1:]
-        if uri in self.paths:
-            return ResponseMock(self.paths[uri])
-        else:
-            return ResponseMock((400, '{}'))
-
-class ResponseMock(requests.Response):
-    def __init__(self, response):
-        self.encoding = 'utf-8'
-        self.status_code = int(response[0])
-        self._content = response[1]
-
-class ToopherIframeTests(unittest.TestCase):
-    request_token = 's9s7vsb'
-
-    def setUp(self):
-        self.iframe_api = toopher.ToopherIframe('abcdefg', 'hijklmnop')
-        self.iframe_api.client.nonce = '12345678'
-        self.old_time = time.time
-        time.time = lambda:1000
-
-    def tearDown(self):
-        time.time = self.old_time
-
-    def test_validate_good_signature_is_successful(self):
-        data = {
-                'foo':'bar',
-                'timestamp':'1000',
-                'session_token':ToopherIframeTests.request_token,
-                'toopher_sig':'6d2c7GlQssGmeYYGpcf+V/kirOI='
-                }
-        try:
-            self.iframe_api.validate(data, ToopherIframeTests.request_token)
-        except toopher.SignatureValidationError:
-            self.fail()
-
-    def test_arrays_get_flattened_for_validate(self):
-        data = {
-                'foo': [ 'bar' ],
-                'timestamp': [ '1000' ],
-                'session_token': [ ToopherIframeTests.request_token ],
-                'toopher_sig':[ '6d2c7GlQssGmeYYGpcf+V/kirOI=' ]
-                }
-        try:
-            self.iframe_api.validate(data, ToopherIframeTests.request_token)
-        except toopher.SignatureValidationError:
-            self.fail()
-
-    def test_immutable_dictionaries_get_copied_for_validate(self):
-        data = werkzeug.datastructures.ImmutableMultiDict([
-                ('foo', 'bar'),
-                ('timestamp', '1000'),
-                ('session_token', ToopherIframeTests.request_token),
-                ('toopher_sig', '6d2c7GlQssGmeYYGpcf+V/kirOI=')
-                ])
-        try:
-            self.iframe_api.validate(data, ToopherIframeTests.request_token)
-        except toopher.SignatureValidationError:
-            self.fail()
-
-    def test_get_pair_uri(self):
-        expected = 'https://api.toopher.test/v1/web/pair?username=jdoe&reset_email=jdoe%40example.com&expires=1100&v=2&oauth_nonce=12345678&oauth_timestamp=1000&oauth_version=1.0&oauth_signature_method=HMAC-SHA1&oauth_consumer_key=abcdefg&oauth_signature=UGlgBEUF6UZEhYPxevJeagqy6D4%3D'
-        self.assertEqual(expected, self.iframe_api.pair_uri('jdoe', 'jdoe@example.com'))
-
-    def test_get_manage_user_uri(self):
-        expected = 'https://api.toopher.test/v1/web/manage_user?username=jdoe&reset_email=jdoe%40example.com&expires=1100&v=2&oauth_nonce=12345678&oauth_timestamp=1000&oauth_version=1.0&oauth_signature_method=HMAC-SHA1&oauth_consumer_key=abcdefg&oauth_signature=sV8qoKnxJ3fxfP6AHNa0eNFxzJs%3D'
-        self.assertEqual(expected, self.iframe_api.manage_user_uri('jdoe', 'jdoe@example.com'))
-
-    def test_get_login_uri(self):
-        expected = 'https://api.toopher.test/v1/web/authenticate?username=jdoe&automation_allowed=True&reset_email=jdoe%40example.com&session_token=s9s7vsb&v=2&allow_inline_pairing=True&requester_metadata=None&challenge_required=False&expires=1100&action_name=Log+In&oauth_nonce=12345678&oauth_timestamp=1000&oauth_version=1.0&oauth_signature_method=HMAC-SHA1&oauth_consumer_key=abcdefg&oauth_signature=URVngBe35eP%2FiFOSQ5ZpuGEYcJs%3D'
-        self.assertEqual(expected, self.iframe_api.login_uri('jdoe', 'jdoe@example.com', ToopherIframeTests.request_token))
-
-    def test_get_login_uri_without_inline_pairing(self):
-        expected = 'https://api.toopher.test/v1/web/authenticate?username=jdoe&automation_allowed=True&reset_email=jdoe%40example.com&session_token=s9s7vsb&v=2&allow_inline_pairing=False&requester_metadata=None&challenge_required=False&expires=1100&action_name=Log+In&oauth_nonce=12345678&oauth_timestamp=1000&oauth_version=1.0&oauth_signature_method=HMAC-SHA1&oauth_consumer_key=abcdefg&oauth_signature=lbz2kuYG3BM2Y0mZLElbTiWPv8A%3D'
-        self.assertEqual(expected, self.iframe_api.login_uri('jdoe', 'jdoe@example.com', ToopherIframeTests.request_token, allow_inline_pairing=False))
-
-
-class ToopherTests(unittest.TestCase):
-    toopher.DEFAULT_BASE_URL = 'https://api.toopher.test/v1'
-
-    def test_constructor(self):
-        def fn():
-            api = toopher.ToopherApi()
-        self.assertRaises(TypeError, fn)
-
-        api = toopher.ToopherApi('key', 'secret')
-
-    def test_version_number_in_library(self):
-        major, minor, patch = toopher.VERSION.split('.')
-        self.assertTrue(int(major) >= 1)
-        self.assertTrue(int(minor) >= 0)
-        self.assertTrue(int(patch) >= 0)
-
-    def test_version_number_in_setup(self):
-        ''' Ensure that the setup.py file has the same version number as the toopher/__init__.py file '''
-        for line in open('setup.py'):
-            if "version" in line:
-                # in setup.py the version is written as "version='1.0.6'," so we need to remove version=' and ',
-                version_number = line.strip().replace("version='", "").replace("',", "")
-                self.assertEqual(version_number, toopher.VERSION)
-
-    def test_create_pairing(self):
-        api = toopher.ToopherApi('key', 'secret')
-        api.client = HttpClientMock({
-            'pairings/create': (200,
-                '{"id":"1", "enabled":true, "user":{"id":"1","name":"some user"}}'
-                )
-            })
-        pairing = api.pair('awkward turtle', 'some user')
-
-        self.assertEqual(api.client.last_called_method, 'POST')
-        self.assertEqual(api.client.last_called_data['pairing_phrase'], 'awkward turtle')
-
-        def fn():
-            self.assertEqual(api.client.last_called_data['test_param'], ['42'])
-        self.assertRaises(KeyError, fn)
-
-    def test_pairing_status(self):
-        api = toopher.ToopherApi('key', 'secret')
-        api.client = HttpClientMock({
-            'pairings/1': (200,
-                '{"id":"1", "enabled":true, "user":{"id":"1","name":"some user"}}'
-                )
-            })
-        pairing = api.get_pairing_status('1')
-        self.assertEqual(api.client.last_called_method, 'GET')
-
-        self.assertEqual(pairing.id, '1')
-        self.assertEqual(pairing.user_name, 'some user')
-        self.assertEqual(pairing.user_id, '1')
-        self.assertTrue(pairing.enabled)
-
-        def fn():
-            foo = pairing.random_key
-        self.assertRaises(AttributeError, fn)
-
-    def test_create_authentication_request(self):
-        api = toopher.ToopherApi('key', 'secret')
-        api.client = HttpClientMock({
-            'authentication_requests/initiate': (200,
-                '{"id":"1", "pending":false, "granted":true, "automated":false, "reason":"its a test", "terminal":{"id":"1", "name":"test terminal"}}'
-                )
-            })
-        auth_request = api.authenticate('1', 'test terminal')
-        self.assertEqual(api.client.last_called_method, 'POST')
-        self.assertEqual(api.client.last_called_data['pairing_id'], '1')
-        self.assertEqual(api.client.last_called_data['terminal_name'], 'test terminal')
-
-        def fn():
-            self.assertEqual(api.client.last_called_data['test_param'], '42')
-        self.assertRaises(KeyError, fn)
-
-        api.authenticate('pairing_id', 'terminal_name', 'action_name')
-
-        last_called_data = api.client.last_called_data
-        self.assertEqual(api.client.last_called_method, 'POST')
-        self.assertEqual(last_called_data['pairing_id'], 'pairing_id')
-        self.assertEqual(last_called_data['terminal_name'], 'terminal_name')
-        self.assertEqual(last_called_data['action_name'], 'action_name')
-
-    def test_authentication_status(self):
-        api = toopher.ToopherApi('key', 'secret')
-        api.client = HttpClientMock({
-            'authentication_requests/1': (200,
-                '{"id":"1", "pending":false, "granted":true, "automated":false, "reason":"its a test", "terminal":{"id":"1", "name":"test terminal"}}'
-                )
-            })
-        auth_request = api.get_authentication_status('1')
-        self.assertEqual(api.client.last_called_method, 'GET')
-        self.assertEqual(auth_request.id, '1')
-        self.assertFalse(auth_request.pending, False)
-        self.assertTrue(auth_request.granted)
-        self.assertFalse(auth_request.automated)
-        self.assertEqual(auth_request.reason, 'its a test')
-        self.assertEqual(auth_request.terminal_id, '1')
-        self.assertEqual(auth_request.terminal_name, 'test terminal')
-
-        def fn():
-            foo = auth_request.random_key
-        self.assertRaises(AttributeError, fn)
-
-    def test_pass_arbitrary_parameters_on_pair(self):
-        api = toopher.ToopherApi('key', 'secret')
-        api.client = HttpClientMock({
-            'pairings/create': (200,
-                '{"id":"1", "enabled":true, "user":{"id":"1","name":"some user"}}'
-                )
-            })
-        pairing = api.pair('awkward turtle', 'some user', test_param='42')
-
-        self.assertEqual(api.client.last_called_method, 'POST')
-        self.assertEqual(api.client.last_called_data['pairing_phrase'], 'awkward turtle')
-        self.assertEqual(api.client.last_called_data['test_param'], '42')
-
-    def test_pass_arbitrary_parameters_on_authenticate(self):
-        api = toopher.ToopherApi('key', 'secret')
-        api.client = HttpClientMock({
-            'authentication_requests/initiate': (200,
-                '{"id":"1", "pending":false, "granted":true, "automated":false, "reason":"its a test", "terminal":{"id":"1", "name":"test terminal"}}'
-                )
-            })
-        auth_request = api.authenticate('1', 'test terminal', test_param='42')
-        self.assertEqual(api.client.last_called_method, 'POST')
-        self.assertEqual(api.client.last_called_data['pairing_id'], '1')
-        self.assertEqual(api.client.last_called_data['terminal_name'], 'test terminal')
-        self.assertEqual(api.client.last_called_data['test_param'], '42')
-
-    def test_access_arbitrary_keys_in_pairing_status(self):
-        api = toopher.ToopherApi('key', 'secret')
-        api.client = HttpClientMock({
-            'pairings/1': (200,
-                '{"id":"1", "enabled":true, "user":{"id":"1","name":"some user"}, "random_key":"84"}'
-                )
-            })
-        pairing = api.get_pairing_status('1')
-        self.assertEqual(api.client.last_called_method, 'GET')
-
-        self.assertEqual(pairing.id, '1')
-        self.assertEqual(pairing.user_name, 'some user')
-        self.assertEqual(pairing.user_id, '1')
-        self.assertTrue(pairing.enabled)
-
-        self.assertEqual(pairing.random_key, "84")
-
-    def test_access_arbitrary_keys_in_authentication_status(self):
-        api = toopher.ToopherApi('key', 'secret')
-        api.client = HttpClientMock({
-            'authentication_requests/1': (200,
-                '{"id":"1", "pending":false, "granted":true, "automated":false, "reason":"its a test", "terminal":{"id":"1", "name":"test terminal"}, "random_key":"84"}'
-                )
-            })
-        auth_request = api.get_authentication_status('1')
-        self.assertEqual(api.client.last_called_method, 'GET')
-        self.assertEqual(auth_request.id, '1')
-        self.assertFalse(auth_request.pending, False)
-        self.assertTrue(auth_request.granted)
-        self.assertFalse(auth_request.automated)
-        self.assertEqual(auth_request.reason, 'its a test')
-        self.assertEqual(auth_request.terminal_id, '1')
-        self.assertEqual(auth_request.terminal_name, 'test terminal')
-
-        self.assertEqual(auth_request.random_key, "84")
-
-    def test_pair_qr(self):
-        api = toopher.ToopherApi('key', 'secret')
-        api.client = HttpClientMock({
-            'pairings/create/qr': (200,
-                json.dumps({'id': 'id',
-                            'enabled': True,
-                            'user': {'id': 'id', 'name': 'name'}}))})
-
-        api.pair_qr('user_name')
-        self.assertEqual(api.client.last_called_method, 'POST')
-        self.assertEqual(api.client.last_called_data['user_name'], 'user_name')
-
-    def test_pair_sms(self):
-        api = toopher.ToopherApi('key', 'secret')
-        api.client = HttpClientMock({
-            'pairings/create/sms': (200,
-                json.dumps({'id': 'id',
-                            'enabled': True,
-                            'user': {'id': 'id', 'name': 'name'}}))})
-
-        api.pair_sms('phone_number', 'user_name')
-        last_called_data = api.client.last_called_data
-        self.assertEqual(api.client.last_called_method, 'POST')
-        self.assertEqual(last_called_data['phone_number'], 'phone_number')
-        self.assertEqual(last_called_data['user_name'], 'user_name')
-
-        api.pair_sms('phone_number', 'user_name', 'phone_country')
-        last_called_data = api.client.last_called_data
-        self.assertEqual(api.client.last_called_method, 'POST')
-        self.assertEqual(last_called_data['phone_number'], 'phone_number')
-        self.assertEqual(last_called_data['user_name'], 'user_name')
-        self.assertEqual(last_called_data['phone_country'], 'phone_country')
-
-    def test_authenticate_with_otp(self):
-        api = toopher.ToopherApi('key', 'secret')
-        api.client = HttpClientMock({
-            'authentication_requests/id/otp_auth': (200,
-                json.dumps({'id': 'id',
-                            'pending': False,
-                            'granted': False,
-                            'automated': False,
-                            'reason': 'it is a test',
-                            'terminal': {'id': 'id', 'name': 'name'}}))})
-
-        api.authenticate_with_otp('id', 'otp')
-        self.assertEqual(api.client.last_called_method, 'POST')
-        self.assertEqual(api.client.last_called_data['otp'], 'otp')
-
-    def test_bad_response_raises_correct_error(self):
-        api = toopher.ToopherApi('key', 'secret')
-        api.client = HttpClientMock({
-            'authentication_requests/initiate': (200,
-                'lol if you think this is json')})
-
-        def fn():
-          api.authenticate_by_user_name('user_name', 'terminal_name')
-        self.assertRaises(toopher.ToopherApiError, fn)
-
-    def test_unrecognized_error_still_raises_error(self):
-        api = toopher.ToopherApi('key', 'secret')
-        api.client = HttpClientMock({
-            'authentication_requests/initiate': (409,
-                json.dumps({'error_code': 42,
-                            'error_message': 'what'}))})
-
-        def fn():
-            api.authenticate_by_user_name('user_name', 'terminal_name')
-        self.assertRaises(toopher.ToopherApiError, fn)
-
-class ZeroStorageTests(unittest.TestCase):
-    def test_create_user_terminal(self):
-        api = toopher.ToopherApi('key', 'secret')
-        api.client = HttpClientMock({'user_terminals/create': (200, '{}')})
-
-        api.create_user_terminal('user_name', 'terminal_name', 'requester_terminal_id')
-
-        last_called_data = api.client.last_called_data
-        self.assertEqual(api.client.last_called_method, 'POST')
-        self.assertEqual(last_called_data['user_name'], 'user_name')
-        self.assertEqual(last_called_data['name'], 'terminal_name')
-        self.assertEqual(last_called_data['name_extra'], 'requester_terminal_id')
-
-    def test_enable_toopher_for_user(self):
-        api = toopher.ToopherApi('key', 'secret')
-        api.client = HttpClientMock({
-            'users': (200, json.dumps([{'id': 'user_id', 'name': 'user_name'}])),
-            'users/user_id': (200, json.dumps({'name': 'user_name'}))})
-
-        api.set_toopher_enabled_for_user('user_name', True)
-        self.assertEqual(api.client.last_called_method, 'POST')
-        self.assertFalse(api.client.last_called_data['disable_toopher_auth'])
-
-        api.set_toopher_enabled_for_user('user_name', False)
-        self.assertEqual(api.client.last_called_method, 'POST')
-        self.assertTrue(api.client.last_called_data['disable_toopher_auth'])
-
-    def test_enable_toopher_multiple_users(self):
-        api = toopher.ToopherApi('key', 'secret')
-        api.client = HttpClientMock({'users': (200,
-            json.dumps([{'name': 'first user'}, {'name': 'second user'}]))})
-
-        def fn():
-            api.set_toopher_enabled_for_user('multiple users', True)
-        self.assertRaises(toopher.ToopherApiError, fn)
-
-    def test_enable_toopher_no_users(self):
-        api = toopher.ToopherApi('key', 'secret')
-        api.client = HttpClientMock({'users': (200, '[]')})
-
-        def fn():
-            api.set_toopher_enabled_for_user('no users', True)
-        self.assertRaises(toopher.ToopherApiError, fn)
-
-
-
-    def test_disabled_user_raises_correct_error(self):
-        api = toopher.ToopherApi('key', 'secret')
-        api.client = HttpClientMock({
-            'authentication_requests/initiate': (409,
-                json.dumps({'error_code': 704,
-                            'error_message': 'disabled user'}))})
-
-        def fn():
-            auth_request = api.authenticate_by_user_name('disabled user', 'terminal name')
-        self.assertRaises(toopher.UserDisabledError, fn)
-
-    def test_unknown_user_raises_correct_error(self):
-        api = toopher.ToopherApi('key', 'secret')
-        api.client = HttpClientMock({
-            'authentication_requests/initiate': (409,
-                json.dumps({'error_code': 705,
-                             'error_message': 'unknown user'}))})
-
-        def fn():
-            auth_request = api.authenticate_by_user_name('unknown user', 'terminal name')
-        self.assertRaises(toopher.UserUnknownError, fn)
-
-    def test_unknown_terminal_raises_correct_error(self):
-        api = toopher.ToopherApi('key', 'secret')
-        api.client = HttpClientMock({
-            'authentication_requests/initiate': (409,
-                json.dumps({'error_code': 706,
-                            'error_message': 'unknown terminal'}))})
-
-        def fn():
-            auth_request = api.authenticate_by_user_name('user', 'unknown terminal name')
-        self.assertRaises(toopher.TerminalUnknownError, fn)
-
-    def test_deactivated_pairing_raises_correct_error(self):
-        api = toopher.ToopherApi('key', 'secret')
-        api.client = HttpClientMock({
-            'authentication_requests/initiate': (409,
-                json.dumps({'error_code': 707,
-                            'error_message': 'Pairing has been deactivated'}))})
-
-        def fn():
-            auth_request = api.authenticate_by_user_name('user', 'terminal name')
-        self.assertRaises(toopher.PairingDeactivatedError, fn)
-
-    def test_unauthorized_pairing_raises_correct_error(self):
-        api = toopher.ToopherApi('key', 'secret')
-        api.client = HttpClientMock({
-            'authentication_requests/initiate': (409,
-                json.dumps({'error_code': 601,
-                            'error_message': 'Pairing has not been authorized'}))})
-
-        def fn():
-            auth_request = api.authenticate_by_user_name('user', 'terminal name')
-        self.assertRaises(toopher.PairingDeactivatedError, fn)
-
-class ddict(dict):
-    def __getitem__(self, key):
-        try:
-            value = super(ddict, self).__getitem__(key)
-            return value
-        except KeyError as e:
-            return ddict()
-
-class AuthenticationStatusTests(unittest.TestCase):
-    def test_incomplete_response_raises_exception(self):
-        response = {'key': 'value'}
-        def fn():
-            toopher.AuthenticationStatus(response)
-        self.assertRaises(toopher.ToopherApiError, fn)
-
-    def test_nonzero_when_granted(self):
-        response = ddict()
-        response['granted'] = True
-        allowed = toopher.AuthenticationStatus(response)
-        self.assertTrue(allowed)
-
-        response['granted'] = False
-        denied = toopher.AuthenticationStatus(response)
-        self.assertFalse(denied)
-
-class PairingStatusTests(unittest.TestCase):
-    def test_incomplete_response_raises_exception(self):
-        response = {'key': 'value'}
-        def fn():
-            toopher.PairingStatus(response)
-        self.assertRaises(toopher.ToopherApiError, fn)
-
-    def test_nonzero_when_granted(self):
-        response = ddict()
-        response['enabled'] = True
-        allowed = toopher.PairingStatus(response)
-        self.assertTrue(allowed)
-
-        response['enabled'] = False
-        denied = toopher.PairingStatus(response)
-        self.assertFalse(denied)
-
-def main():
-    unittest.main()
-
-if __name__ == '__main__':
-    main()
diff --git a/toopher/__init__.py b/toopher/__init__.py
index 5afa6e3..4a439d3 100644
--- a/toopher/__init__.py
+++ b/toopher/__init__.py
@@ -1,292 +1,2 @@
-import os
-from oauthlib import oauth1
-import urllib
-import hashlib
-import hmac
-import base64
-import time
-import requests_oauthlib
-import sys
-
-DEFAULT_BASE_URL = "https://api.toopher.com/v1"
-DEFAULT_IFRAME_TTL = 100
-IFRAME_VERSION = '2'
-VERSION = '1.1.0'
-
-class ToopherApiError(Exception): pass
-class UserDisabledError(ToopherApiError): pass
-class UserUnknownError(ToopherApiError): pass
-class TerminalUnknownError(ToopherApiError): pass
-class PairingDeactivatedError(ToopherApiError): pass
-
-ERROR_CODE_USER_DISABLED = 704
-ERROR_CODE_USER_UNKNOWN = 705
-ERROR_CODE_TERMINAL_UNKNOWN = 706
-ERROR_CODE_PAIRING_DEACTIVATED = 707
-
-error_codes_to_errors = {ERROR_CODE_USER_DISABLED: UserDisabledError,
-                         ERROR_CODE_USER_UNKNOWN: UserUnknownError,
-                         ERROR_CODE_TERMINAL_UNKNOWN: TerminalUnknownError,
-                         ERROR_CODE_PAIRING_DEACTIVATED: PairingDeactivatedError}
-
-class SignatureValidationError(Exception): pass
-
-class ToopherIframe(object):
-
-    def __init__(self, key, secret, api_uri=None):
-        self.secret = secret
-        self.client = oauth1.Client(key, client_secret=secret, signature_type=oauth1.SIGNATURE_TYPE_QUERY)
-        api_uri = api_uri if api_uri else DEFAULT_BASE_URL
-        self.base_uri = api_uri.rstrip('/')
-
-    def pair_uri(self, username, reset_email, ttl = DEFAULT_IFRAME_TTL):
-        params = {
-                'v':IFRAME_VERSION,
-                'username':username,
-                'reset_email':reset_email
-                }
-        return self.get_oauth_uri(self.base_uri + '/web/pair', params, ttl)
-
-    def manage_user_uri(self, username, reset_email, ttl=DEFAULT_IFRAME_TTL):
-        params = {
-                'v':IFRAME_VERSION,
-                'username':username,
-                'reset_email':reset_email
-                }
-        return self.get_oauth_uri(self.base_uri + '/web/manage_user', params, ttl)
-
-    def auth_uri(self, username, reset_email, action_name, automation_allowed, challenge_required, request_token, requester_metadata, ttl=DEFAULT_IFRAME_TTL, allow_inline_pairing=True):
-        params = {
-                'v':IFRAME_VERSION,
-                'username':username,
-                'reset_email':reset_email,
-                'action_name':action_name,
-                'automation_allowed':automation_allowed,
-                'challenge_required':challenge_required,
-                'session_token':request_token,
-                'requester_metadata':requester_metadata,
-                'allow_inline_pairing':allow_inline_pairing
-                }
-        return self.get_oauth_uri(self.base_uri + '/web/authenticate', params, ttl)
-
-    def login_uri(self, username, reset_email, request_token, **kwargs):
-        return self.auth_uri(username, reset_email, 'Log In', True, False, request_token, 'None', DEFAULT_IFRAME_TTL, **kwargs)
-
-    def validate(self, data, request_token=None, ttl=DEFAULT_IFRAME_TTL):
-        # make a mutable copy of the data
-        data = dict(data)
-
-        # flatten data if necessary
-        if hasattr(data.values()[0], '__iter__'):
-            data = dict((k,v[0]) for (k,v) in data.items())
-
-        missing_keys = []
-        for required_key in ('toopher_sig', 'timestamp', 'session_token'):
-            if not required_key in data:
-                missing_keys.append(required_key)
-
-        if missing_keys:
-            raise SignatureValidationError("Missing required keys: {0}".format(missing_keys))
-
-        if request_token:
-            if request_token != data.get('session_token'):
-                raise SignatureValidationError("Session token does not match expected value!")
-
-        maybe_sig = data['toopher_sig']
-        del data['toopher_sig']
-        signature_valid = False
-        try:
-            computed_signature  =self.signature(data)
-            signature_valid = maybe_sig == computed_signature
-        except Exception, e:
-            raise SignatureValidationError("Error while calculating signature", e)
-
-        if not signature_valid:
-            raise SignatureValidationError("Computed signature does not match submitted signature: {0} vs {1}".format(computed_signature, maybe_sig))
-
-        ttl_valid = int(time.time()) - int(data['timestamp']) < ttl
-        if not ttl_valid:
-            raise SignatureValidationError("TTL expired")
-
-        return data
-
-    def signature(self, data):
-        to_sign = urllib.urlencode(sorted(data.items())).encode('utf-8')
-        secret = self.client.client_secret.encode('utf-8')
-        return base64.b64encode(hmac.new(secret, to_sign, hashlib.sha1).digest())
-
-    def get_oauth_uri(self, uri, params, ttl):
-        params['expires'] = str(int(time.time()) + ttl)
-        return self.client.sign(uri + '?' + urllib.urlencode(params))[0]
-
-
-class ToopherApi(object):
-    def __init__(self, key, secret, api_url=None):
-        self.client = requests_oauthlib.OAuth1Session(key, client_secret=secret)
-        self.client.verify = True
-
-        base_url = api_url if api_url else DEFAULT_BASE_URL
-        self.base_url = base_url.rstrip('/')
-
-    def pair(self, pairing_phrase, user_name, **kwargs):
-        uri = self.base_url + "/pairings/create"
-        params = {'pairing_phrase': pairing_phrase,
-                  'user_name': user_name}
-
-        params.update(kwargs)
-
-        result = self._request(uri, "POST", params)
-        return PairingStatus(result)
-
-    def pair_qr(self, user_name, **kwargs):
-        uri = self.base_url + '/pairings/create/qr'
-        params = {'user_name': user_name}
-        params.update(kwargs)
-        result = self._request(uri, 'POST', params)
-        return PairingStatus(result)
-
-    def pair_sms(self, phone_number, user_name, phone_country=None):
-        uri = self.base_url + "/pairings/create/sms"
-        params = {'phone_number': phone_number,
-                  'user_name': user_name}
-
-        if phone_country:
-            params['phone_country'] = phone_country
-
-        result = self._request(uri, "POST", params)
-        return PairingStatus(result)
-
-    def get_pairing_status(self, pairing_id):
-        uri = self.base_url + "/pairings/" + pairing_id
-
-        result = self._request(uri, "GET")
-        return PairingStatus(result)
-
-    def authenticate(self, pairing_id, terminal_name, action_name=None, **kwargs):
-        uri = self.base_url + "/authentication_requests/initiate"
-        params = {'pairing_id': pairing_id,
-                  'terminal_name': terminal_name}
-        if action_name:
-            params['action_name'] = action_name
-
-        params.update(kwargs)
-
-        result = self._request(uri, "POST", params)
-        return AuthenticationStatus(result)
-
-    def get_authentication_status(self, authentication_request_id):
-        uri = self.base_url + "/authentication_requests/" + authentication_request_id
-
-        result = self._request(uri, "GET")
-        return AuthenticationStatus(result)
-
-    def authenticate_with_otp(self, authentication_request_id, otp):
-        uri = self.base_url + "/authentication_requests/" + authentication_request_id + '/otp_auth'
-        params = {'otp' : otp}
-        result = self._request(uri, "POST", params)
-        return AuthenticationStatus(result)
-
-    def authenticate_by_user_name(self, user_name, terminal_name_extra, action_name=None, **kwargs):
-        kwargs.update(user_name=user_name, terminal_name_extra=terminal_name_extra)
-        return self.authenticate('', '', action_name, **kwargs)
-
-    def create_user_terminal(self, user_name, terminal_name, requester_terminal_id):
-        uri = self.base_url + '/user_terminals/create'
-        params = {'user_name': user_name,
-                  'name': terminal_name,
-                  'name_extra': requester_terminal_id}
-        self._request(uri, 'POST', params)
-
-    def set_toopher_enabled_for_user(self, user_name, enabled):
-        uri = self.base_url + '/users'
-        params = {'name': user_name}
-        users = self._request(uri, 'GET', params)
-
-        if len(users) > 1:
-            raise ToopherApiError('Multiple users with name = %s' % user_name)
-        elif not len(users):
-            raise ToopherApiError('No users with name = %s' % user_name)
-
-        uri = self.base_url + '/users/' + users[0]['id']
-        params = {'disable_toopher_auth': not enabled}
-        self._request(uri, 'POST', params)
-
-    def _request(self, uri, method, params=None):
-        data = {'params' if method == 'GET' else 'data': params}
-        header_data = {'User-Agent':'Toopher-Python/%s (Python %s)' % (VERSION, sys.version.split()[0])}
-
-        response = self.client.request(method, uri, headers=header_data, **data)
-        try:
-            content = response.json()
-        except ValueError:
-            raise ToopherApiError('Response from server could not be decoded as JSON.')
-
-        if response.status_code >= 400:
-            self._parse_request_error(content)
-
-        return content
-
-    def _parse_request_error(self, content):
-        error_code = content['error_code']
-        error_message = content['error_message']
-        if error_code in error_codes_to_errors:
-            error = error_codes_to_errors[error_code]
-            raise error(error_message)
-
-        if 'pairing has not been authorized' in error_message.lower():
-            raise PairingDeactivatedError(error_message)
-
-        raise ToopherApiError(error_message)
-
-class PairingStatus(object):
-    def __init__(self, json_response):
-        try:
-            self.id = json_response['id']
-            self.enabled = json_response['enabled']
-
-            user = json_response['user']
-            self.user_id = user['id']
-            self.user_name = user['name']
-        except Exception as e:
-            raise ToopherApiError("Could not parse pairing status from response" + e.message)
-
-        self._raw_data = json_response
-
-    def __nonzero__(self):
-        return self.enabled
-
-    def __getattr__(self, name):
-        if name.startswith('__') or name not in self._raw_data:  # Exclude 'magic' methods to allow for (un)pickling
-            return super(PairingStatus, self).__getattr__(name)
-        else:
-            return self._raw_data[name]
-
-
-class AuthenticationStatus(object):
-    def __init__(self, json_response):
-        try:
-            self.id = json_response['id']
-            self.pending = json_response['pending']
-            self.granted = json_response['granted']
-            self.automated = json_response['automated']
-            self.reason = json_response['reason']
-
-            terminal = json_response['terminal']
-            self.terminal_id = terminal['id']
-            self.terminal_name = terminal['name']
-        except Exception:
-            raise ToopherApiError("Could not parse authentication status from response")
-
-        self._raw_data = json_response
-
-    def __nonzero__(self):
-        return self.granted
-
-    def __getattr__(self, name):
-        if name.startswith('__') or name not in self._raw_data:  # Exclude 'magic' methods to allow for (un)pickling
-            return super(AuthenticationStatus, self).__getattr__(name)
-        else:
-            return self._raw_data[name]
-
-
-class ToopherApiError(Exception): pass
+from .toopher_api import *
+from .toopher_iframe import *
diff --git a/toopher/toopher_api.py b/toopher/toopher_api.py
new file mode 100644
index 0000000..b22c5e6
--- /dev/null
+++ b/toopher/toopher_api.py
@@ -0,0 +1,369 @@
+import uuid
+import requests_oauthlib
+import sys
+
+DEFAULT_BASE_URL = 'https://api.toopher.com/v1'
+VERSION = '2.0.0'
+
+class ToopherApiError(Exception): pass
+class UserDisabledError(ToopherApiError): pass
+class UserUnknownError(ToopherApiError): pass
+class TerminalUnknownError(ToopherApiError): pass
+class PairingDeactivatedError(ToopherApiError): pass
+
+ERROR_CODE_USER_DISABLED = 704
+ERROR_CODE_USER_UNKNOWN = 705
+ERROR_CODE_TERMINAL_UNKNOWN = 706
+ERROR_CODE_PAIRING_DEACTIVATED = 707
+
+error_codes_to_errors = {ERROR_CODE_USER_DISABLED: UserDisabledError,
+                         ERROR_CODE_USER_UNKNOWN: UserUnknownError,
+                         ERROR_CODE_TERMINAL_UNKNOWN: TerminalUnknownError,
+                         ERROR_CODE_PAIRING_DEACTIVATED: PairingDeactivatedError}
+
+class ToopherApi(object):
+    def __init__(self, key, secret, api_url=None):
+        self.advanced = AdvancedApiUsageFactory(key, secret, api_url, self)
+
+    def pair(self, username, phrase_or_num=None, **kwargs):
+        params = {'user_name': username}
+        params.update(kwargs)
+        if phrase_or_num:
+            if any(c.isdigit() for c in phrase_or_num):
+                url = '/pairings/create/sms'
+                params.update(phone_number=phrase_or_num)
+            else:
+                url = '/pairings/create'
+                params.update(pairing_phrase=phrase_or_num)
+        else:
+            url = '/pairings/create/qr'
+
+        result = self.advanced.raw.post(url, **params)
+        return Pairing(result, self)
+
+    def authenticate(self, id_or_username, terminal_name=None, requester_specified_id=None, action_name=None, **kwargs):
+        url = '/authentication_requests/initiate'
+        try:
+            uuid.UUID(id_or_username)
+            params = {'pairing_id': id_or_username}
+        except:
+            params = {'user_name': id_or_username}
+        if terminal_name:
+            params['terminal_name'] = terminal_name
+        if requester_specified_id:
+            params['requester_specified_terminal_id'] = requester_specified_id
+        if action_name:
+            params['action_name'] = action_name
+        params.update(kwargs)
+
+        result = self.advanced.raw.post(url, **params)
+        return AuthenticationRequest(result, self)
+
+
+class AdvancedApiUsageFactory(object):
+    def __init__(self, key, secret, api_url, api):
+        self.raw = ApiRawRequester(key, secret, api_url)
+        self.pairings = Pairings(api)
+        self.authentication_requests = AuthenticationRequests(api)
+        self.users = Users(api)
+        self.user_terminals = UserTerminals(api)
+
+
+class ApiRawRequester(object):
+    def __init__(self, key, secret, api_url):
+        self.client = requests_oauthlib.OAuth1Session(key, client_secret=secret)
+        self.client.verify = True
+
+        base_url = api_url or DEFAULT_BASE_URL
+        self.base_url = base_url.rstrip('/')
+
+    def get(self, endpoint, **kwargs):
+        url = self.base_url + endpoint
+        return self._request(url, 'GET', kwargs)
+
+    def get_raw(self, endpoint):
+        url = self.base_url + endpoint
+        return self._request(url, 'GET', raw_request=True)
+
+    def post(self, endpoint, **kwargs):
+        url = self.base_url + endpoint
+        return self._request(url, 'POST', kwargs)
+
+    def _request(self, uri, method, params=None, raw_request=False):
+        data = {'params' if method == 'GET' else 'data': params}
+        header_data = {'User-Agent':'Toopher-Python/%s (Python %s)' % (VERSION, sys.version.split()[0])}
+
+        response = self.client.request(method, uri, headers=header_data, **data)
+        try:
+            content = response.json()
+        except ValueError:
+            raise ToopherApiError('Response from server could not be decoded as JSON.')
+
+        if response.status_code >= 400:
+            self._parse_request_error(content)
+
+        if raw_request:
+            return response.content
+        else:
+            return content
+
+    def _parse_request_error(self, content):
+        error_code = content['error_code']
+        error_message = content['error_message']
+        if error_code in error_codes_to_errors:
+            error = error_codes_to_errors[error_code]
+            raise error(error_message)
+
+        if 'pairing has not been authorized' in error_message.lower():
+            raise PairingDeactivatedError(error_message)
+
+        raise ToopherApiError(error_message)
+
+
+class ToopherObjectFactory(object):
+    def __init__(self, api):
+        self.api = api
+
+
+class Pairings(ToopherObjectFactory):
+    def get_by_id(self, pairing_id):
+        url = '/pairings/' + pairing_id
+        result = self.api.advanced.raw.get(url)
+        return Pairing(result, self.api)
+
+
+class AuthenticationRequests(ToopherObjectFactory):
+    def get_by_id(self, authentication_request_id):
+        url = '/authentication_requests/' + authentication_request_id
+        result = self.api.advanced.raw.get(url)
+        return AuthenticationRequest(result, self.api)
+
+
+class UserTerminals(ToopherObjectFactory):
+    def create(self, username, terminal_name, requester_specified_id, **kwargs):
+        url = '/user_terminals/create'
+        params = {'user_name': username,
+                  'name': terminal_name,
+                  'name_extra': requester_specified_id}
+        params.update(kwargs)
+        result = self.api.advanced.raw.post(url, **params)
+        return UserTerminal(result, self.api)
+
+    def get_by_id(self, terminal_id):
+        url = '/user_terminals/' + terminal_id
+        result = self.api.advanced.raw.get(url)
+        return UserTerminal(result, self.api)
+
+
+class Users(ToopherObjectFactory):
+    def create(self, username, **kwargs):
+        url = '/users/create'
+        params = {'name': username}
+        params.update(kwargs)
+        result = self.api.advanced.raw.post(url, **params)
+        return User(result, self.api)
+
+    def get_by_id(self, user_id):
+        url = '/users/' + user_id
+        result = self.api.advanced.raw.get(url)
+        return User(result, self.api)
+
+    def get_by_name(self, username):
+        url = '/users'
+        users = self.api.advanced.raw.get(url, name=username)
+
+        if len(users) > 1:
+            raise ToopherApiError('Multiple users with name = %s' % username)
+        elif not len(users):
+            raise ToopherApiError('No users with name = %s' % username)
+
+        return User(users[0], self.api)
+
+
+class ToopherBase(object):
+    def __getattr__(self, name):
+        if name.startswith('__') or name not in self.raw_response:  # Exclude 'magic' methods to allow for (un)pickling
+            return super(ToopherBase, self).__getattribute__(name)
+        else:
+            return self.raw_response[name]
+
+
+class Pairing(ToopherBase):
+    def __init__(self, json_response, api):
+        self.api = api
+        self.raw_response = json_response
+        try:
+            self.id = json_response['id']
+            self.enabled = json_response['enabled']
+            self.pending = json_response['pending']
+            self.user = User(json_response['user'], api)
+        except Exception as e:
+            raise ToopherApiError('Could not parse pairing from response: %s' % e.args)
+
+    def __nonzero__(self):
+        return self.enabled
+
+    def refresh_from_server(self):
+        url = '/pairings/' + self.id
+        result = self.api.advanced.raw.get(url)
+        self._update(result)
+
+    def get_qr_code_image(self):
+        url = '/qr/pairings/' + self.id
+        return self.api.advanced.raw.get_raw(url)
+
+    def get_reset_link(self, **kwargs):
+        if not 'security_question' in kwargs:
+            kwargs['security_question'] = None
+        if not 'security_answer' in kwargs:
+            kwargs['security_answer'] = None
+
+        url = '/pairings/' + self.id + '/generate_reset_link'
+        result = self.api.advanced.raw.post(url, **kwargs)
+        return result['url']
+
+    def email_reset_link(self, email, **kwargs):
+        params = {'reset_email': email}
+        params.update(kwargs)
+        url = '/pairings/' + self.id + '/send_reset_link'
+        self.api.advanced.raw.post(url, **params)
+
+    def _update(self, json_response):
+        self.raw_response = json_response
+        try:
+            self.enabled = json_response['enabled']
+            self.pending = json_response['pending']
+            self.user._update(json_response['user'])
+        except Exception as e:
+            raise ToopherApiError('Could not parse pairing from response: %s' % e.args)
+
+
+class AuthenticationRequest(ToopherBase):
+    def __init__(self, json_response, api):
+        self.api = api
+        self.raw_response = json_response
+        try:
+            self.id = json_response['id']
+            self.pending = json_response['pending']
+            self.granted = json_response['granted']
+            self.automated = json_response['automated']
+            self.reason = json_response['reason']
+            self.reason_code = json_response['reason_code']
+            self.terminal = UserTerminal(json_response['terminal'], api)
+            self.user = User(json_response['user'], api)
+            self.action = Action(json_response['action'])
+        except Exception as e:
+            raise ToopherApiError('Could not parse authentication request from response: %s' % e.args)
+
+    def __nonzero__(self):
+        return self.granted
+
+
+    def grant_with_otp(self, otp, **kwargs):
+        url = '/authentication_requests/' + self.id + '/otp_auth'
+        params = {'otp' : otp}
+        params.update(kwargs)
+        result = self.api.advanced.raw.post(url, **params)
+        self._update(result)
+
+    def refresh_from_server(self):
+        url = '/authentication_requests/' + self.id
+        result = self.api.advanced.raw.get(url)
+        self._update(result)
+
+    def _update(self, json_response):
+        self.raw_response = json_response
+        try:
+            self.pending = json_response['pending']
+            self.granted = json_response['granted']
+            self.automated = json_response['automated']
+            self.reason = json_response['reason']
+            self.reason_code = json_response['reason_code']
+            self.terminal._update(json_response['terminal'])
+            self.user._update(json_response['user'])
+            self.action._update(json_response['action'])
+        except Exception as e:
+            raise ToopherApiError('Could not parse authentication request from response: %s' % e.args)
+
+
+class User(ToopherBase):
+    def __init__(self, json_response, api):
+        self.api = api
+        self.raw_response = json_response
+        try:
+            self.id = json_response['id']
+            self.name = json_response['name']
+            self.toopher_authentication_enabled = json_response['toopher_authentication_enabled']
+        except Exception as e:
+            raise ToopherApiError('Could not parse user from response: %s' % e.args)
+
+    def refresh_from_server(self):
+        url = '/users/' + self.id
+        result = self.api.advanced.raw.get(url)
+        self._update(result)
+
+    def enable_toopher_authentication(self):
+        url = '/users/' + self.id
+        result = self.api.advanced.raw.post(url, toopher_authentication_enabled=True)
+        self._update(result)
+
+    def disable_toopher_authentication(self):
+        url = '/users/' + self.id
+        result = self.api.advanced.raw.post(url, toopher_authentication_enabled=False)
+        self._update(result)
+
+    def reset(self):
+        url = '/users/reset'
+        params = {'user_name': self.name}
+        self.api.advanced.raw.post(url, **params)
+
+    def _update(self, json_response):
+        self.raw_response = json_response
+        try:
+            self.name = json_response['name']
+            self.toopher_authentication_enabled = json_response['toopher_authentication_enabled']
+        except Exception as e:
+            raise ToopherApiError('Could not parse user from response: %s' % e.args)
+
+
+class UserTerminal(ToopherBase):
+    def __init__(self, json_response, api):
+        self.api = api
+        self.raw_response = json_response
+        try:
+            self.id = json_response['id']
+            self.name = json_response['name']
+            self.requester_specified_id = json_response['requester_specified_id']
+            self.user = User(json_response['user'], api)
+        except Exception as e:
+            raise ToopherApiError('Could not parse user terminal from response: %s' % e.args)
+
+    def refresh_from_server(self):
+        url = '/user_terminals/' + self.id
+        result = self.api.advanced.raw.get(url)
+        self._update(result)
+
+    def _update(self, json_response):
+        self.raw_response = json_response
+        try:
+            self.name = json_response['name']
+            self.requester_specified_id = json_response['requester_specified_id']
+            self.user._update(json_response['user'])
+        except Exception as e:
+            raise ToopherApiError('Could not parse user terminal from response: %s' % e.args)
+
+class Action(ToopherBase):
+    def __init__(self, json_response):
+        self.raw_response = json_response
+        try:
+            self.id = json_response['id']
+            self.name = json_response['name']
+        except Exception as e:
+            raise ToopherApiError('Could not parse action from response %s' % e.args)
+
+    def _update(self, json_response):
+        self.raw_response = json_response
+        try:
+            self.name = json_response['name']
+        except Exception as e:
+            raise ToopherApiError('Could not parse action from response: %s' % e.args)
diff --git a/toopher/toopher_iframe.py b/toopher/toopher_iframe.py
new file mode 100644
index 0000000..2c37829
--- /dev/null
+++ b/toopher/toopher_iframe.py
@@ -0,0 +1,193 @@
+from oauthlib import oauth1
+import urllib
+from urllib.parse import urlparse
+import hashlib
+import hmac
+import base64
+import time
+import logging
+from .toopher_api import *
+
+DEFAULT_BASE_URL = 'https://api.toopher.com/v1'
+DEFAULT_IFRAME_TTL = 300
+IFRAME_VERSION = '2'
+
+class SignatureValidationError(ToopherApiError): pass
+
+class ToopherIframe(object):
+    logging.basicConfig(format='%(levelname)s: %(message)s')
+
+    def __init__(self, key, secret, api_uri=None):
+        self.key = key
+        self.secret = secret
+        self.client = oauth1.Client(key, client_secret=secret, signature_type=oauth1.SIGNATURE_TYPE_QUERY)
+        api_uri = api_uri if api_uri else DEFAULT_BASE_URL
+        self.base_uri = api_uri.rstrip('/')
+
+    def get_authentication_url(self, username, reset_email='', request_token='', action_name='Log In', requester_metadata='', **kwargs):
+        if not 'ttl' in kwargs:
+            ttl = DEFAULT_IFRAME_TTL
+        else:
+            ttl = kwargs.pop('ttl')
+
+        params = {
+            'username':username,
+            'reset_email':reset_email,
+            'action_name':action_name,
+            'session_token':request_token,
+            'requester_metadata':requester_metadata
+        }
+        params.update(kwargs)
+
+        return self._get_oauth_signed_url(self.base_uri + '/web/authenticate', params, ttl)
+
+    def get_user_management_url(self, username, reset_email='', **kwargs):
+        if not 'ttl' in kwargs:
+            ttl = DEFAULT_IFRAME_TTL
+        else:
+            ttl = kwargs.pop('ttl')
+
+        params = {
+                'username':username,
+                'reset_email':reset_email
+                }
+        params.update(kwargs)
+
+        return self._get_oauth_signed_url(self.base_uri + '/web/manage_user', params, ttl)
+
+    def process_postback(self, urlencoded_toopher_data, request_token='', **kwargs):
+        toopher_data = self._urldecode_iframe_data(urlencoded_toopher_data)
+
+        if 'error_code' in toopher_data:
+            error_message = toopher_data['error_message']
+            error = error_codes_to_errors[int(toopher_data['error_code'])]
+            raise error(error_message)
+        else:
+            validated_data = self._validate_data(toopher_data, request_token, kwargs)
+            toopher_api = ToopherApi(self.key, self.secret, self.base_uri)
+            resource_type = validated_data['resource_type']
+            if resource_type == 'authentication_request':
+                return AuthenticationRequest(self._create_authentication_request_dict(validated_data), toopher_api)
+            elif resource_type == 'pairing':
+                return Pairing(self._create_pairing_dict(validated_data), toopher_api)
+            elif resource_type == 'requester_user':
+                return User(self._create_user_dict(validated_data), toopher_api)
+            else:
+                raise ToopherApiError('The postback resource type is not valid: {0}'.format(resource_type))
+
+    def is_authentication_granted(self, data, request_token='', **kwargs):
+        try:
+            authentication_request = self.process_postback(data, request_token, **kwargs)
+            if isinstance(authentication_request, AuthenticationRequest):
+                return authentication_request.granted and not authentication_request.pending
+            else:
+                logging.warning('The postback did not return an AuthenticationRequest')
+                return False
+        except UserDisabledError as e:
+            logging.info(e)
+            return True
+        except Exception as e:
+            logging.error(e)
+            return False
+
+    def _urldecode_iframe_data(self, data):
+        data_dict = urlparse.parse_qs(data, True)
+        return dict((k,v[0]) for (k,v) in data_dict.items())
+
+    def _validate_data(self, data, request_token, kwargs):
+
+        self._check_for_missing_keys(data)
+        self._verify_session_token(data.get('session_token'), request_token)
+        self._check_if_signature_is_expired(data.get('timestamp'), kwargs)
+        self._validate_signature(data)
+        return data
+
+    def _check_for_missing_keys(self, data):
+        missing_keys = []
+        for required_key in ('toopher_sig', 'timestamp', 'session_token'):
+            if not required_key in data:
+                missing_keys.append(required_key)
+
+        if missing_keys:
+            raise SignatureValidationError('Missing required keys: {0}'.format(', '.join(missing_keys)))
+
+    def _verify_session_token(self, session_token, request_token):
+        if request_token:
+            if request_token != session_token:
+                raise SignatureValidationError('Session token does not match expected value!')
+
+    def _check_if_signature_is_expired(self, timestamp, kwargs):
+        ttl = kwargs.pop('ttl') if 'ttl' in kwargs else DEFAULT_IFRAME_TTL
+        ttl_valid = int(time.time()) - int(timestamp) < ttl
+        if not ttl_valid:
+            raise SignatureValidationError('TTL expired')
+
+    def _validate_signature(self, data):
+        maybe_sig = data['toopher_sig']
+        del data['toopher_sig']
+
+        try:
+            computed_signature = self._calculate_signature(data)
+        except Exception as e:
+            raise SignatureValidationError('Error while calculating signature: {0}'.format(e.args[0]))
+
+        if not maybe_sig == computed_signature:
+            raise SignatureValidationError('Computed signature does not match submitted signature: {0} vs {1}'.format(computed_signature, maybe_sig))
+
+    def _create_authentication_request_dict(self, data):
+        return {
+            'id': data['id'],
+            'pending': data['pending'] == 'true',
+            'granted': data['granted'] == 'true',
+            'automated': data['automated'] == 'true',
+            'reason': data['reason'],
+            'reason_code': data['reason_code'],
+            'terminal': {
+                'id': data['terminal_id'],
+                'name': data['terminal_name'],
+                'requester_specified_id': data['terminal_requester_specified_id'],
+                'user': {
+                    'id': data['pairing_user_id'],
+                    'name': data['user_name'],
+                    'toopher_authentication_enabled': data['user_toopher_authentication_enabled'] == 'true'
+                }
+            },
+            'user': {
+                'id': data['pairing_user_id'],
+                'name': data['user_name'],
+                'toopher_authentication_enabled': data['user_toopher_authentication_enabled'] == 'true'
+            },
+            'action': {
+                'id': data['action_id'],
+                'name': data['action_name']
+            }
+        }
+
+    def _create_pairing_dict(self, data):
+        return {
+            'id': data['id'],
+            'enabled': data['enabled'] == 'true',
+            'pending': data['pending'] == 'true',
+            'user': {
+                'id': data['pairing_user_id'],
+                'name': data['user_name'],
+                'toopher_authentication_enabled': data['user_toopher_authentication_enabled'] == 'true'
+            }
+        }
+
+    def _create_user_dict(self, data):
+        return {
+            'id': data['id'],
+            'name': data['name'],
+            'toopher_authentication_enabled': data['toopher_authentication_enabled'] == 'true'
+        }
+
+    def _calculate_signature(self, data):
+        to_sign = urllib.urlencode(sorted(data.items())).encode('utf-8')
+        secret = self.client.client_secret.encode('utf-8')
+        return base64.b64encode(hmac.new(secret, to_sign, hashlib.sha1).digest())
+
+    def _get_oauth_signed_url(self, uri, params, ttl):
+        params['expires'] = str(int(time.time()) + ttl)
+        params['v'] = IFRAME_VERSION
+        return self.client.sign(uri + '?' + urllib.urlencode(params))[0]
\ No newline at end of file