Create multi project api tokens

[Thorsten Kamann]

Hello,

I am working on an project for Dev Containers and the TWG CLI should be provisioned via environment variables. For TWG you need multi project tokens, but if I want to create a token with scopes, then I can only choose one app, eg. Jira OR Confluence, not both.

Some weeks ago (round about May) this was possible, I have an old api token with scopes for Bitbucket, Confluence and Jira.

Is this a bug, a feature or something else, that scoped tokens are only for one app.

Thanks
Thorsten

[Arkadiusz Wroblewski]

Hello @Thorsten Kamann 

This change was around May 

[Thorsten Kamann]

Mhh, I tired it with a classic api token, but then I get for a Jira Query a 401. With my old scoped token from mid of may the query was successfull. 

So I haven't any chance to use a new token and get it up and running?

[Arkadiusz Wroblewski]

You may still have one workable option. The 401 from the classic token could be caused by how TWG CLI selects the authentication method.

In TWG CLI 1.0.23 and later TWG_TOKEN alone is sent as a Bearer token.
When TWG_USER is also configured, TWG sends the credentials using Basic authentication.

A classic Atlassian API token is normally used with your Atlassian account email through Basic authentication. Please therefore update TWG CLI first:

twg update
twg --version

Then configure both variables:

TWG_USER=your-atlassian-email@example.com
TWG_TOKEN=your-classic-atlassian-api-token
TWG_BBC_TOKEN=your-bitbucket-token

After restarting the container, run twg doctor

The important difference is that you should not test the classic token through TWG_TOKEN. Without TWG_USER, current TWG versions treat it as a Bearer token, which can result in the 401 you received.

For Jira and Confluence, the classic token is broader than a scoped token, so it should have a short expiration and be stored as a Dev Container.

The preferred long-term model remains OAuth through twg login

with the TWG configuration directory persisted or mounted into the Dev Container. Bitbucket still requires the separate TWG_BBC_TOKEN.

[Thorsten Kamann]

Now, its work again. Thanks.

[Arkadiusz Wroblewski]

@Thorsten Kamann 

Super :) Glad to hear that.

[Shalini R]

I noticed the same change. Previously, it was possible to create a single scoped API token that covered multiple Atlassian products, but now the UI seems to restrict tokens to a single app. If that's intentional, it would be helpful to have confirmation from the Atlassian team, as it impacts workflows that rely on multi-product access, such as TWG CLI provisioning.

[Thorsten Kamann]

Same here. My plan is to create one token with the necessary scopes for Jira, Confluence and Bitbucket und give this the TWG CLI. Now you need one classic Token and one scoped token only for Bitbucket.

[Gor Greyan]

Hi @Thorsten Kamann

Based on the current Atlassian documentation, this appears to be the expected behavior rather than a bug. I think this was changed after May.
The documentation doesn't describe a way to create a new scoped token that spans multiple Atlassian products.

https://support.atlassian.com/atlassian-account/docs/manage-api-tokens-for-your-atlassian-account

If this capability is important for your workflow, I'd recommend raising a feature request or contacting Atlassian Support to confirm whether the previous multi-product behavior was intentionally removed or if it's an undocumented regression.