We connect our users to the Rovo MCP server through AWS Bedrock AgentCore Gateway. Each user signs in with their own Atlassian account (OAuth, authorization code flow). We set it up by following "Method B" in this AWS article: https://builder.aws.com/content/3I8jOM1EV0VTNuRpeN3kayk3rLS/connect-atlassian-tools-to-amazon-bedrock-agentcore-gateway-with-oauth-20-3lo
This works today with v1. We would now like to move to v2, and we need to know which values to
put in our OAuth settings.
This is the exact command we run for V1 (dynamic client registration):
curl -s -X POST https://mcp.atlassian.com/v1/register -H "Content-Type: application/json" -d '{"client_name":"<our client name>","client_uri":"https://bedrock-agentcore.eu-west-1.amazonaws.com","redirect_uris":["https://bedrock-agentcore.eu-west-1.amazonaws.com/identities/oauth2/callback/<provider id>"],"grant_types":["authorization_code","refresh_token"],"response_types":["code"],"token_endpoint_auth_method":"client_secret_post"}'
The response gives us a client ID and a client secret, plus a registration_client_uri but no
registration_access_token. We found no way to update or delete the client afterwards, so every
time our callback URL changes we have to register a new client.
What we use today (v1):
Field | v1 value | v2 value |
|---|
MCP endpoint | https://mcp.atlassian.com/v1/mcp | ? |
Issuer | https://mcp.atlassian.com | ? |
Authorization endpoint | https://mcp.atlassian.com/v1/authorize | ? |
Token endpoint | https://mcp.atlassian.com/v1/token | ? |
Response type | code | ? |
Client authentication method | client_secret_post | ? |
Client registration endpoint | https://mcp.atlassian.com/v1/register | ? |
Scopes | read:jira-work, write:jira-work, read:jira-user, offline_access | ? |
Extra parameters on the authorize request | none | ? |
Our questions:
- For v2 (https://mcp.atlassian.com/v2/mcp), what values should we use for each item in the table above.
- How should a v2 client be registered, and can it be updated or deleted later? Is there a supported alternative to calling the registration endpoint by hand?
- Do we need to send any extra parameter at sign-in (for example prompt=consent), and how long do access and refresh tokens last?
Will OAuth on v1 be retired, and when? Is there an official list of v2 tool names and fields we can use as a fixed list?
Thank you.
