Jira API with Basic Auth and Service Account

[Martin Törnqvist]

Hi! Is it possible to make calls to the Jira API using Basic Auth and a Service Account? I've tried the Get all projects endpoint, but I can't get it to work no matter which scopes I set on my generated API token (even if enabling all the scopes under Classic).

Is it just not possible to use the Jira API with Service Accounts and Basic Auth? Or am I doing something wrong? This is the Python script I'm using to test:

import requests
from requests.auth import HTTPBasicAuth
import json

mail = <service account mail>
token = <service account token>
auth = HTTPBasicAuth(mail, token)

headers = {
    'Accept': 'application/json'
}

api_url = "https://<company name>.atlassian.net/rest/api/latest/project"

response = requests.request("GET", api_url, headers=headers, auth=auth)

print("Status Code:", response.status_code)
projects = json.loads(response.text)
print("Number of projects:", len(projects))

This script always returns a status code of 200, and 0 projects (which is what I've understood will happen if the token does not have the correct access).

NOTE: I can get the script working if I use my own e-mail and create a non-scoped token using that, but it would be much better if we could use a service account for this.

[Dirk Ronsmans · Accepted solution]

Hi @Martin Törnqvist ,

While your general logic is fine, the new Service Accounts don't use the same base-url as you would regullary use. (and the same for a personal scoped api token)

You need to use a base URL to make API requests: api.atlassian.com

Then you can construct a request to call the API for the app you’d like to access.

If you use the companyname.atlassian.net domain it won't work. It's confusing at first but once you use the api.atlassian.com base url with the organization id the rest of the logic remains the same, the endpoints work the same way.

Below is the documentation excerpt from Confluence Cloud but the same applies for Jira

Use scoped tokens with Cloud REST API

Scoped tokens also require you to input your Cloud ID, which is unique to your cloud site and app combination. You can refer to this guide to get the CloudID: How to Find Your Atlassian Cloud Site's Cloud ID.

Once you have both the token and your Cloud ID, you can make requests to the API at this URL:

https://api.atlassian.com/ex/confluence/<cloudid>/<api>

Replace <cloudid> with your Confluence Cloud instance ID, and <api> with the specific endpoint you'd like to access.

[Martin Törnqvist]

Thanks for the reply! So in short, the scoped tokens only work with OAuth2.0 authorization + authentication, not by authenticating with Basic Auth directly?

EDIT: Ah, nevermind, this solution actually works! I was just confused about the first link that talked about OAuth2.0. Thanks a lot!

[Dirk Ronsmans]

You can use them but not with Basic Auth, however if you sent it as a Bearer token it should work :)

So with an Authorization header with:

Authorization Bearer [token]

[Malin Tausch]

Hey!

Normally you should be able to use a service account with Basic Auth + API Token. That account must be a licenced Jira user with permissions to view the projects you want to query. So make sure you give the sccount the necessary App permissions. Otherwise you will always get [] back.

Atlassian also offeres some more information about those accounts and how to manage/use API tokens for them:

- Understand Sevice Accounts 

- Manage API Tokens for Service accounts 

[Martin Törnqvist]

Thanks for the answer!

As part of debugging I created an API token for my own user with all Classic scopes enabled, but I still wasn't able to get the projects using the script above. And I know my user has the correct permissions, since it works when I create a non-scoped token. Do you know what the reason for this could be?

[Malin Tausch]

I think that Basic Auth only works for classic API tokens (tokens without scopes). If you want to use tokens with scopes you should try using OAuth 2.0 intergration.

Useful links

Create OAuth 2.o credentials for service accounts 

Authentication for Jira Cloud API