Hello, I am tasked to write an integration to pull data from Jira cloud. The cloud has oauth 2 auth with the app and such already set up. I am following this documentation here (https://developer.atlassian.com/cloud/jira/platform/oauth-2-3lo-apps/#frequently-asked-questions).
The constraint is that this is integration is a script running from a node server which will not be able to open a web page to authorize and get that code from the URL in step one.
Is there anyway around this such as different api call?
Also, I tried to manually inputting the generated auth code into the script for the POST call in step 2 but it still doesn't like it.
Hello @John Huynh ,
From your explanation:
this is integration is a script running from a node server which will not be able to open a web page
Therefore, as written in the Jira Cloud platform Developer - Security Overview page, Oauth2 is not the right way to go. You should use Basic authentication with an Atlassian account email address and API token instead:
[...] Security is implemented differently, depending on what you are building: Forge apps Connect apps OAuth 2.0 (3LO) apps Scripts or other REST API clients [...] Scripts and other REST API clients Scripts and other REST API clients use basic authentication. Basic authentication uses an API token to authenticate the client. The token is generated from a user's Atlassian Account, encoded, then added to the header for requests to the API. Authorization for basic authentication is based on the permissions of the user you used to generate the API token. For example, if you're using basic authentication, your user must have the Administer projects permission for a project to call PUT /rest/api/3/project/{projectIdOrKey} (Update project). We recommend that you only use basic authentication if you have other security measures in place. To learn more, read Basic auth for REST APIs.
[...]
Security is implemented differently, depending on what you are building:
Scripts and other REST API clients use basic authentication. Basic authentication uses an API token to authenticate the client. The token is generated from a user's Atlassian Account, encoded, then added to the header for requests to the API.
Authorization for basic authentication is based on the permissions of the user you used to generate the API token. For example, if you're using basic authentication, your user must have the Administer projects permission for a project to call PUT /rest/api/3/project/{projectIdOrKey} (Update project).
PUT /rest/api/3/project/{projectIdOrKey}
We recommend that you only use basic authentication if you have other security measures in place.
To learn more, read Basic auth for REST APIs.
I hope this helps.
Finally, for the future, please notice that this is not the best place to get help on development related questions. The right resources are listed in https://developer.atlassian.com/resources.
Specifically:
Cheers,Dario
Hi Dario,
Thanks for the reply. Just a follow up question, would oauth1 method be the same as it requires a verification code from the callback url?
Best,
John
@John Huynh ,
Oauth1 could actually work in your case, I didn't mention it since it is deprecated and I am not sure if it will be removed in the near future.
That's because, even if you need to authenticate request token once in order to get the access token, this will then last 5 years as mentioned in the documentation:
An access code is all that is needed to make an authenticated request to the Jira REST API. Requests are made as the user who authorized the initial request token. The access token will persist for 5 years, unless it is revoked.
For more details please see:
@Dario B
Good to know! For my specific case, what is the recommended best practice?
Also if I go down the Oauth1 path, what would these two properties be in translated to in the request headers as?
Thanks,
It looks like you're new here. Sign in or register to get started.
