How to use the access token for REST calls?

Cameron Stillio

I've finally cracked the code of using JIRA authentication endpoints with OAuth.  It wasn't easy, but the key was using the RSA-SHA1 algorithm (not very standard - most implementations use HMAC-SHA1) - and the private key in the consumer-secret. BTW, when will OAuth2 be available???

Anyway, now that I do the 3-legged dance, and I have an oauth_token... now - how do I use it? I can't find a single example of actually using that token in an HTTP request for the REST interface.

Typically I would format it into the header of a request like so:

{ "Authorization" : "Bearer gZ9qgJLEaNJh3349VEIbCQ9jm7baNAbcDefgVjFqJY" }

But this doesn't seem to do the trick, even for a very simple query. 

How should the auth_token be formatted and used? I can't find any examples or instructions on this...

Cameron Stillio

Each of the sample clients use libraries which use other libraries - and the stack is deep. My biggest problem with the documentation and the samples is that they do not provide actual HTTP examples - they hide the details in curl or some other shared library. That is all well and good if you don't need to understand it, or just need to implement what someone else already has, using a library someone already has. But I read the blogs and I am not the only one that finds this approach - wanting.

I have no problem using RSA-SHA1 or acquiring the access token, but every example i've seen after that step uses curl with basic auth to access data - which is somewhat pointless. Every OAuth 1.0a server (and actually every OAuth 2 server) differ in implementation - I am looking for the similarities and the differences. I'm not using the languages or libraries that are covered so far in the published samples, I am left to experiment to find out these implementation necessities. Again, I am not the only one.

My next step is to follow the OAuth bible and see if that gets me where I want to go. A tangible sample with HTTP request and response for each would be much better than a collection of specific-library-built-samples. Everyone who approaches this, it seems, is left to dissect a sample that is not in the language they are using to try to glean the basic protocol. That's like teaching students how to be a doctor by sending them to the morgue to do autopsies. There might be a better way.