Difference between OAuth2 token and API key?

[KC Wong]

I have a service account. 

I'm trying to use REST API to read/update issues using: 
https://api.atlassian.com/ex/jira/<Cloud ID>/rest/api/2/issue/<IssueKey>
or 
https://<MyDomain>.atlassian.net/rest/api/2/issue/<IssueKey>

If I create an API key, give it scopes read:jira-work and write:jira-work, it works. 

But if I create an OAuth2 token, give it the same scopes, it doesn't work saying I do not have permission to the issue. 

Given it's the same service account, it cannot be anything related to permissions. What additional scopes do the OAuth2 token need and why? 

[Arkadiusz Wroblewski]

Hello @KC Wong 

For an OAuth 2.0 credential created for an Atlassian service account, the documented request is through the Atlassian API gateway:

https://api.atlassian.com/ex/jira/{cloudId}/rest/api/2/issue/{issueKey}: Authorization: Bearer <ACCESS_TOKEN>

Here some official resources https://support.atlassian.com/user-management/docs/create-oauth-2-0-credential-for-service-accounts/ 

https://support.atlassian.com/user-management/docs/manage-api-tokens-for-service-accounts/ 

Best,

Arek 🤠