how to access auth token in forge app resolver?

[ankit jangid]

I have carefully reviewed the Forge documentation and understand that user/app authentication tokens are accessible within Forge remote backends. However, I am seeking to access an authentication token directly within a resolver, thereby eliminating the need for an external backend solely for token retrieval. While I am aware that asApp() and asUser() suffice for making calls to product APIs without explicit authentication tokens, my objective is to obtain a bearer authentication token to call other Atlassian APIs. Is there a method to access such a bearer authentication token within a Forge app?

[Tim Pettersen]

@Lucas Modzelewski _Lumo_ is correct — you can't extract the token used by `asApp()` or `asUser()`.

@ankit jangid may I ask which other Atlassian APIs you're attempting to call?

If the API does not support OAuth scopes, you can instead:

- generate a personal access token and set it as a Forge environment variable (use the `--encrypt` flag given it's a credential)

- override the `Authorization` header on the request to use the access token

However this will mean the app will authenticate with the API as the user you generated the access token for.

Please also note that this is also only suitable for apps that you're deploying for use in your own organisation. Our Security Requirements prohibit Marketplace Apps from soliciting API tokens from users. 

Hope this helps!

Tim

[Lucas Modzelewski _Lumo_]

You can’t directly access the user’s OAuth/JWT/bearer token in Forge resolvers (for security reasons) - that’s by design in the Forge platform.

The actual token is never exposed to your app code or frontend, so it can't be leaked or misused.