Jira Cloud OAuth 2.0: Are existing access tokens invalidated when a refresh token is used?

Question

Hi Team,

I’m integrating Jira Cloud REST APIs using OAuth 2.0 (3LO) and noticed some unexpected token invalidation behavior during automation.

Here’s my current setup:

* I obtain an access token and refresh token via the authorization code flow.
* The access token is used for various API calls (create issues, update project settings, etc.).
* When the access token expires, my automation uses the refresh token to get a new pair of tokens (access + refresh).
* I then replace the old refresh token with the newly generated one (since the old one becomes invalid).

However, I’ve observed that as soon as the refresh token is used, all existing API calls using the old access token start failing with 401 Unauthorized, even though the access token’s exp value still indicates 1 hour of validity.

So I wanted to confirm,

* Does Jira Cloud revoke all access tokens that were issued using a refresh token when that refresh token is used to obtain a new pair?
* Is this behavior part of Jira’s implementation of rotating refresh tokens, meaning that both the old refresh token and all access tokens derived from it become invalid?
* If so, what’s the recommended approach for handling this in multi-threaded or distributed automation (where multiple workers might still be using the old access token when a refresh occurs)?

This seems to explain why I occasionally get 401 Unauthorized errors right after a token refresh, even though the access token hasn’t yet reached its expiry time.

Thanks,
Gopal

Marc -Devoteam- · Accepted Answer

Hi @gopal guna

I think the answer on this is yes.

But I think the best is to raise this with Atlassian Support (you nee to be an admin in your instance to raise requests).

Otherwise your question could be answered in the Developer community.

But based on your label that you are on a free subscription, you don't have rights to support (this is stated in the free subscription agreement)

unknown · Accepted Answer

Hello @gopal guna

Does Jira Cloud revoke all access tokens that were issued using a refresh token when that refresh token is used to obtain a new pair?

No. Jira doesn't revoke access tokens (plural) that were (plural) issued when using a refresh token (singular). It only revokes the one access token (singular) that was (singular) issued when using a refresh token (singular) associated with the token.

That is OAuth 2.0 working exactly as it is supposed to.... one new access token and one new refresh token being issued per one refresh request for each original OAuth token, and the prior one access token becoming invalid.

This is why you have "...observed that as soon as the refresh token is used, all existing API calls using the old access token start failing"

Is this behaviour part of Jira’s implementation of rotating refresh tokens, meaning that both the old refresh token and all access tokens derived from it become invalid?

No. There are not multiple access tokens (plural) derived from a refresh cycle, only one access token (singular), as I previously described.

If so, what’s the recommended approach for handling this in multi-threaded or distributed automation (where multiple workers might still be using the old access token when a refresh occurs)?

As per my previous reply to that same question... don't use one, single OAuth token for multiple or concurrent automation workflows. Don't give one, single OAuth token to multiple workers. Each should have their own, separate token and refresh it individually.

To me, it sounds like you are generating a single OAuth access token, then using it for 'everything', then when any one of those things performs the required refresh cycle and gets the new access token, all the other things will somehow 'know' about that and somehow 'switch' to the new access token.... but you have created no mechanism by which that 'knowing and switching' process will happen with all those things.