Getting a 401-Unauthorized Error on REST APi In one App and other works good

[mantrax314]

I have successfully obtained my auth access_token from https://auth.atlassian.com/oauth/token

{
"access_token": "****",
"refresh_token": "****",
"scope": "read:jira-work read:jira-user read:me read:account offline_access",
"expires_in": 3600,
"token_type": "Bearer"
}

However when I try something like

curl --location --request GET 'https://subdomain.atlassian.net/rest/api/3/issue/TICKET-KEY' \

--header 'Authorization: Bearer ***' \

--header 'Cookie: atlassian.xsrf.token=*****'

I get

Encountered a 401 - Unauthorized error while loading this page.

On the other hand, I have success trying this one

curl --location --request GET 'https://api.atlassian.com/me' \
--header 'Authorization: Bearer ****'

Any suggestion of what I'm doing wrong? I have another integration which is working perfecto and has the following scope

"scope": "read:jira-work read:jira-user offline_access",

Any help will be very appreciated.

[Neil]

Hi @mantrax314 and welcome to the community! Just for future reference, you should post questions like these over on the Developer Community forums: https://community.developer.atlassian.com.

But since we're all here already, I'll try to provide some guidance. You've built an OAuth 2 3LO app, correct? If so, the docs here (https://developer.atlassian.com/cloud/confluence/oauth-2-3lo-apps/) state that you need to make a call using the cloudId of your site. Jump down to section 3 of the doc page above.

The API call to your Jira instance should look something like this:

curl --request GET \
       --url https://api.atlassian.com/ex/jira/cloudId/rest/api/3/issue/TICKET' \
       --header 'Authorization: Bearer *****' \
       --header 'Accept: application/json'

TL;DR: You can only make API calls to yoursite.atlassian.com if you're using basic auth with an API token, or from your browser with a cookie-based session. OAuth 2.0 3LO apps need to use the cloudId.

Hope this helps!

[mantrax314]

Thank you for all your help Neil

The weird part of this is I am able to retrieve the ticket information using the same endpoints but using a different app authentication.

[Neil]

The weird part of this is I am able to retrieve the ticket information using the same endpoints but using a different app authentication.

Indeed. As I said in that last paragraph, you can call yoursite.atlassian.com if you're using basic auth (with token) or through your browser with cookie-based session auth.

If your app is an OAuth 2 3LO-based app, you need to make API calls through api.atlassian.com/ex/jira/cloudId instead. 

[Joe Barbour]

Thanks for this Neil, I have been looking for this solution all morning!

On the documentation page for version 3 REST it still documents using yoursite.atlassian.com as the host, rather than specifying the cloud ID.

It might be worth looking into updating the documentation as if basic auth is deprecated and this hosting type is only used on basic auth I think any continued reference of hosts without the cloud id is gonna cause further confusion.

Either way. I appreciate your comment as it's helped greatly!

[kimi Raatikainen]

---

Token kimi