How can I store sensitive data in JIRA ondemand

[Jean Jean]

I am building an atlassian-connect application, and  I need to store some oauth tokens (authentication tokens, refresh tokens,...), I do not want to store it in the app itself because of security concerns.

I was looking at different options:

• Store them as application properties via JIRA REST API?
• Store them as Project level entity properties, but it is accessible for all JIRA users.
• Store them as user preferences.

Is there any other place where I can store sensitive data in JIRA on demand via REST API?

or any other suggestion?

Thanks in advance!

[Travis Smith · Accepted solution]

So JIRA does not really have a place where you can store sensitive data. If it is sensitive, then you would need to store it in an external service (your add-on) where you can manage access better.

[Jean Jean]

You were right Travis, also if anyone else trying something similar, it is not possible to execute GET or PUT requests to /mypreferences JIRA REST endpoint from an Atlassian Connect Addon, it is because of SCOPES. https://developer.atlassian.com/static/connect/docs/scopes/jira-rest-scopes.html

No scope available for /mypreferences endpoint.