How to authenticate against atlassian-connect-express endpoints using cURL

[Wouter Van Vlaenderen]

So I generated a new atlassian-connect-express addon for Jira and defined the following routes.

app.get('/hello-world-authenticate', addon.authenticate(), function (req, res) {
        res.json({"title": "protected using authenticate"});
    }
);

app.get('/hello-world-check-valid-token', addon.checkValidToken(), function (req, res) {
        res.json({"title": "protected using checkValidToken"});
    }
);

app.get('/hello-world-public', function (req, res) {
        res.json({"title": "public"});
    }
);

After registering the ACE add-on I get the following output, and I am able to cURL the public endpoint succesfully.

Local tunnel established at https://3c45bb5b.ngrok.io/ 

% curl https://3c45bb5b.ngrok.io/hello-world-public

{"title":"public"}

cURL commands towards the authenticated endpoints fail, which makes sense since no authentication information is provided.

% curl https://3c45bb5b.ngrok.io/hello-world-authenticate

Could not find authentication data on request

% curl https://3c45bb5b.ngrok.io/hello-world-check-valid-token

Could not find authentication data on request

I've been made aware that a JWT token can be requested issuing a POST command using basic authentication towards https://<your-id>.atlassian.net/rest/auth/1/session.

curl -H "Content-Type: application/json" -X POST -d '{"username":"<your-username>","password":"<your-password>"}' https://<your-id>.atlassian.net/rest/auth/1/session 

{"session":{"name":"cloud.session.token","value":"<received-jwt-token>"}}

Providing the JWT token to the above endpoints results in following output.

% curl "https://3c45bb5b.ngrok.io/hello-world-authenticate?jwt=<received-jwt-token>"

JWT claim did not contain the query string hash (qsh) claim

% curl "https://3c45bb5b.ngrok.io/hello-world-check-valid-token?jwt=<received-jwt-token>" 

Could not find stored client data for atlassian. Is this client registered?

It seems I am unable to authenticate towards my ACE endpoints. What should be the correct procedure for authenticating ACE endpoints? What tokens should be set, and how should they be acquired? 

I want my custom endpoints to be called based on a cron job so for simplicity I prefer autentication data being passed using the HTTP headers.

Source can be found at https://bitbucket.org/wvanvlaenderen/atlassian-connect-express-authentication-demo