Jira rest api call fails

Question

Jira rest api (version 3) calls made using OAuth 2.0 fail. It worked for sometime with a new token then started failing. Regenerated the auth code and token but still fails. calls made with basic auth work fine. The problem is only while using OAuth 2.0.

status code: 401

error: 'Client must be authenticated to access this resource.'

Dario B · Answer

Hi @Kalidoss M ,

As mentioned in the already provided documentation, in your scenario you should be able to use OAuth 1.0a.

Otherwise, as you mentioned, another option would be indeed to use basic authentication with API Token.

Please click on both links, review both documentation pages and choose the one that fits best your needs.

Cheers,
Dario

Kalidoss M · Answer

Hey @Dario B,

Thanks for helping me out with this, I appreciate your effort. Now I am clear that I can't use OAuth 2.0 in my use case since it requires user authorisation every time we request for authorisation code. May I know if I can use OAuth 1.0? or does OAuth 1.0 also require user authorisation all the time?

If OAuth 1.0 also doesn't work for me then I will have to go with basic auth.

Thanks,

Kalidoss M

Dario B · Answer

@Kalidoss M

I have just seen your reply to the Support ticket:

I am using OAuth 2.0. i am able to generate Authorization code through
browser but unable to generate it through my webservice since it requires
atlassian user to login & click "Accept" button in order to generate
Authorization code and redirect the site with Authorization code.

Unfortunately there is no UI component in my application (Only APIs). So
trying to find out a way to get the Authorization code without having to
click "Accept" button.

If this is the case then, as written on the top of the OAuth 2.0 (3LO) for apps documentation page, you should not be using Oauth 2.0 but Oauth 1.0:

Which authentication method should I use?

* Connect apps: Use JWT. You can also use OAuth 2.0 user impersonation.
* Other apps: Use OAuth 2.0 (3LO) for authentication and authorization.
* Not using an app: Use OAuth 1.0a.

This is because, as written in the same documentation page, the first step for implementing Oauth 2 is to implement the code to Direct the user to the authorization URL to get an authorization code. The user will then log in (if not logged in already) and grant access from the browser, etc etc.

I hope this helps.

Cheers,
Dario