How do I get a site admin to authorize the Atlassian Rovo MCP Server

[Aishwarya Markad]

We are trying to use the official Atlassian Rovo MCP Server with Claude Code on our Atlassian Cloud site. When developers try to complete the OAuth 2.1 consent flow, we get the error:

  "Your site admin must authorize this app before it can access your account."

  As per the official GitHub documentation, a site admin must complete the 3LO consent flow first. However we are unable to identify how to get our site admin to do this or where in the Atlassian Admin panel this setting is located.

 Can someone please guide us on the exact steps a site admin needs to follow to authorize the Atlassian Rovo MCP Server ?

[Gabriela - LeanZero]

Hi Aishwarya, there's no screen where an admin pre-approves the Rovo MCP Server, which is why yours can't find one. It isn't a Marketplace app, so it doesn't sit in the admin panel waiting to be approved. Atlassian's own README puts it plainly: it "is not installed via the Atlassian Marketplace or the Manage apps screen. Instead, it is installed automatically the first time a user completes the OAuth 2.1 (3LO) consent flow". Until someone consents, the app isn't on your site. Nothing there to approve yet. Pre-approving one ahead of that is still an open request, CLOUD-11676.

The GitHub line you quoted is right. Your site admin does have to be first through that flow, and they do it from a client, not from the admin panel. On their own machine:

claude mcp add --transport http atlassian https://mcp.atlassian.com/v1/mcp/authv2

then /mcp in a Claude Code session, and approve in the browser. Any client that runs the Atlassian OAuth flow will do, it only has to be the admin's own account.

Which account they use matters. It's where Enterprise orgs usually trip. Same README: "The first user to complete the 3LO consent flow for your site must have access to the Atlassian apps requested by the MCP scopes (for example, Jira and/or Confluence)." An admin-only account with no Jira licence won't register it.

Atlassian's KB for that exact error does point admins at Apps, your site, Connected apps. That is the right screen, it sits empty until the consent above happens, and that's the loop you're in. Once the app is listed, check the Settings tab there has user-installed apps allowed, or your developers get stopped anyway.

The install registers per site rather than per org, so the consent has to be against the same site your developers are hitting. And if your admin hits that same error on their own consent, that isn't a setting they've missed, and it's one for Support.

[Jean Horn]

Hi there! 👋

Welcome to the Atlassian Community!

Setting up the official Atlassian Rovo MCP Server with AI developer tools like Claude Code is an awesome step forward, but encountering the standard OAuth 2.1 authorization error during initial setup can certainly be a roadblock!

You are spot on with your assumption. The error "Your site admin must authorize this app before it can access your account" happens because the MCP integration requires a one-time initial approval and domain authorization from an administrator at the organization level.

Yes, this is configured directly in Atlassian Administration. Your Organization or Site Admin needs to go to admin.atlassian.com, open Rovo settings, and manage the Rovo MCP server configuration to grant access, review permissions, and whitelist/allow the connecting tool domains.

Step-by-Step Guide for Site / Org Admins

Please share these exact steps with your Organization Admin or Site Admin:

1. Go to Atlassian Administration at admin.atlassian.com.
2. Select your Organization (if you manage multiple).
3. In the main menu, navigate to Rovo > Rovo MCP server (or under Apps > AI settings > Rovo MCP server).
4. From this management dashboard, your admin can configure:
   • Allowed Domains: Add or enable the domain/callback URL associated with your AI tool (e.g., Anthropic / Claude.ai / local client proxy).
   • Permissions: Review and set Read/Write/Search boundaries for Rovo across Jira, Confluence, and Compass.
   • Authentication Methods: Verify that standard OAuth 2.1 is enabled (or enable API Tokens for headless/service-based access if needed).
5. Initial 3LO Consent: The admin should initiate/approve the first consent prompt for the Cloud site so the app registers site-wide permissions. Once authorized by the admin, other developers on the team will be able to complete their individual OAuth log-ins smoothly!

   Official Atlassian Description:
   "The Rovo MCP server enables AI tools, like ChatGPT or Claude.ai, to connect to Atlassian apps. Each AI tool is associated with a domain. You can also enable API tokens for non-interactive or service-based access to the Rovo MCP server."

Relevant Notes & Permissions

• Required Roles: The user performing these steps must hold the Organization Admin or Site Admin role. Standard Jira/Confluence project admins cannot authorize org-level MCP apps.
• Hosting Context: Atlassian Rovo and the Rovo MCP Server are Atlassian Cloud-only features.
• Per-User Scopes: Even after admin authorization, each developer’s queries are strictly bound to their own user permissions within Atlassian Cloud.

Community Wrap-Up

Please give this setup a try with your Organization Admin and let us know if this resolves the authorization error for your dev team!

If this response solves your issue, please click Accept Answer so other community members facing the same Rovo MCP setup hurdles can find this guide easily. Happy coding 🚀

[Rilwan Ahmed]

Hi @Aishwarya Markad ,

Before you can implement OAuth 2.0 (3LO) for your app, you need to enable it for your app using the developer console.

1. From any page on developer.atlassian.com, select your profile icon in the top-right corner, and from the dropdown, select Developer console.
2. Select your app from the list (or create one if you don't already have one).
3. Select Authorization in the left menu.
4. Next to OAuth 2.0 (3LO), select Configure.
5. Enter the Callback URL. Set this to any URL that is accessible by the app. When you implement OAuth 2.0 (3LO) in your app, the redirect_uri must match this URL.
6. Click Save changes.

More details in https://developer.atlassian.com/cloud/jira/service-desk/oauth-2-authorization-code-grants-3lo-for-apps/ 

[Aishwarya Markad]

Hi @Rilwan Ahmed , thank you for responding. However this is not what I am looking for. I am not building an app. I am an end user trying to use the official Atlassian Rovo MCP Server with Claude Code. The error I get is: Your site admin must authorize this app before it can access your account. As per the official GitHub documentation, the site admin needs to be the first person to complete the 3LO consent flow. Could you please advise what exact steps the site admin needs to follow in the Atlassian Admin panel to authorize the Rovo MCP Server for our organization?