Does JIRA REST API v3 support Authorization Code with PKCE grant type for OAuth 2.0

[joonas.laukka]

Hi!

I'm aware that you do not support the implicit grant flow of OAuth 2.0. As far as I know, the Authorization Code with PKCE grant is supposed to replace the implicit grant as a safer alternative.

Do you support the Authorization Code with PKCE grant when authorizing to the JIRA REST API?

PS. I've already tried it and it does not seem to work unless one specifies the `client_secret` in the request that exchanges the authorization code to the access token. This kind of defeats the purpose since I want to use OAuth 2.0 in a public client (the secret can't be exposed).

[AJ Byrne]

Hi Joonas,

I too am facing the same issue and have tried for hours to get this thing to work. Constantly getting 401 errors saying I’m unauthorised.

Though I can’t provide you a solution to the problem, I can tell you that your are not on your own.

Ive tried reading the documentation over and over and it doesn’t get any clearer.

If you have found a solution by now, please point me towards it! Otherwise I would recommend looking into secret managers offered by cloud service providers such as Google Cloud or AWS. (eg: Google Cloud Secret Manager)