Permissions / scopes nightmare with tokens

[Julien CURRO]

Hello,

I am trying to automate a workflow where I need to read and then update a given issue from AI.

I have been trying through MCP but I had that error :

Error: {"error":true,"message":"TWG request failed: 401 Unauthorized. slauthtoken: authorization header found, 'slauth' prefix missing"}

So I wanted to skip MCP and use acli instead, but then I am unable to find what are the right scope to associate to the token to successfully authenticate.

As soon as I use scoped token, I get "Error: Unauthorized; scope does not match". With a token without any scope everything works well but I need to use a "limited" token in that context.

Any idea before I end up making a simple curl ... ?

[Marc -Devoteam-]

Hi @Julien CURRO 

Welcome to the community.

You can't use a scoped token with ACLI, as stated here; https://developer.atlassian.com/cloud/acli/reference/commands/jira-auth-login/ 

On using MCP, is the token Basic or Bearer, you need to provide, this, this what "prefix missing" indicates.

You need to provide the encoding in the authorization step.

[Julien CURRO]

Not sure to understand what prefix you are talking about.

Additional details I can provide : 

❯

print ticket jira PKEY-400 from https://mycompany.atlassian.net/

⏺

atlassian2 - Get Teamwork Graph object (beta) (MCP)

(cloudId: "mycompany.atlassian.net", objects: ["https://mycompany.atlassian.net/browse/PKEY-400"])

⎿  

Error: {"error":true,"message":"TWG request failed: 401 Unauthorized. slauthtoken: authorization header found, 'slauth' prefix missing"}

That's what i'm getting with that .mcp.json file : 

{ "mcpServers": { "atlassian2": { "type": "http", "url": "https://mcp.atlassian.com/v1/mcp", "headers": { "Authorization": "Basic my_token" } } } } 

"my_token" being a base64 of : my_mail:token_rovo_mcp

And the token use the following scopes :

Read :
read:account
read:jira-user
read:me
read:jira-work
read:home:mcp
Write : write:jira-work

[Marc -Devoteam-]

Hi @Julien CURRO 

As you seem to touch a BETA function this might not work as expected.

Best is to raise this to Atlassian Support.

I mentioned prefix, per connecting as you didn't mention that you already where connected. 

Also is this de Forge MCP or Rovo MCP you are using?

[Julien CURRO]

I don't know what is Forge so I think i'm using Rovo MCP.

[Julien CURRO]

I ended up doing basic curl, it's useless to have so many interoperability methods if none works correctly...

[Tomislav Tobijas]

@Julien CURRO Quick info (might not be related to what you're seeing) - we've noticed authorization issues with scoped API tokens since this morning. I know we're currently trying to use service accounts for one new implementation, and we get pretty similar response to what you're seeing.

⚠️ On top of that, some clients reported failing automations or scripts that use the same concept, so it might be the case that it's a global issue; nothing is posted on Atlassian Statuspage (yet).

We've raised a support ticket, and we're currently waiting for a reply. 

As we're talking about troubleshooting MCP integration, you could potentially check the following discussion group Atlassian Rovo MCP Server or maybe folks in the developer community can share some additional insights 👀

Cheers,
Tobi