nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Permissions / scopes nightmare with tokens

Julien CURRO

Hello,

I am trying to automate a workflow where I need to read and then update a given issue from AI.

I have been trying through MCP but I had that error :

Error: {"error":true,"message":"TWG request failed: 401 Unauthorized. slauthtoken: authorization header found, 'slauth' prefix missing"}

So I wanted to skip MCP and use acli instead, but then I am unable to find what are the right scope to associate to the token to successfully authenticate.

As soon as I use scoped token, I get "Error: Unauthorized; scope does not match". With a token without any scope everything works well but I need to use a "limited" token in that context.

Any idea before I end up making a simple curl ... ?

Accepted answers

Marc -Devoteam-

Hi @Julien CURRO

Welcome to the community.

You can't use a scoped token with ACLI, as stated here; https://developer.atlassian.com/cloud/acli/reference/commands/jira-auth-login/

On using MCP, is the token Basic or Bearer, you need to provide, this, this what "prefix missing" indicates.

You need to provide the encoding in the authorization step.

All comments

Tomislav Tobijas

@Julien CURRO Quick info (might not be related to what you're seeing) - we've noticed authorization issues with scoped API tokens since this morning. I know we're currently trying to use service accounts for one new implementation, and we get pretty similar response to what you're seeing.

⚠️ On top of that, some clients reported failing automations or scripts that use the same concept, so it might be the case that it's a global issue; nothing is posted on Atlassian Statuspage (yet).

We've raised a support ticket, and we're currently waiting for a reply.

As we're talking about troubleshooting MCP integration, you could potentially check the following discussion group Atlassian Rovo MCP Server or maybe folks in the developer community can share some additional insights 👀

Cheers,
Tobi

Marc -Devoteam-

Hi @Julien CURRO

Welcome to the community.

You can't use a scoped token with ACLI, as stated here; https://developer.atlassian.com/cloud/acli/reference/commands/jira-auth-login/

On using MCP, is the token Basic or Bearer, you need to provide, this, this what "prefix missing" indicates.

You need to provide the encoding in the authorization step.

Julien CURRO

Not sure to understand what prefix you are talking about.

Additional details I can provide :

❯

print ticket jira PKEY-400 from https://mycompany.atlassian.net/

⏺

atlassian2 - Get Teamwork Graph object (beta) (MCP)

(cloudId: "mycompany.atlassian.net", objects: ["https://mycompany.atlassian.net/browse/PKEY-400"])

⎿

Error: {"error":true,"message":"TWG request failed: 401 Unauthorized. slauthtoken: authorization header found, 'slauth' prefix missing"}

That's what i'm getting with that .mcp.json file :

{ "mcpServers": { "atlassian2": { "type": "http", "url": "https://mcp.atlassian.com/v1/mcp", "headers": { "Authorization": "Basic my_token" } } } }

"my_token" being a base64 of : my_mail:token_rovo_mcp

And the token use the following scopes :

Read :
read:account
read:jira-user
read:me
read:jira-work
read:home:mcp
Write : write:jira-work

Marc -Devoteam-

Hi @Julien CURRO

As you seem to touch a BETA function this might not work as expected.

Best is to raise this to Atlassian Support.

I mentioned prefix, per connecting as you didn't mention that you already where connected.

Also is this de Forge MCP or Rovo MCP you are using?

Julien CURRO

I don't know what is Forge so I think i'm using Rovo MCP.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

jira

cloud

jira-cloud

rovo

acli

mcp