How to use API token for REST calls in Python.

[Marvin Hoffman]

I'm currently intending to use the Jira API to pull data for more robust reporting. I am using Python 3.6, and the Python requests library.

Currently this works:

r = requests.get(jira_url_critquery, auth=('[username]','[password]'))

But I'd rather use the API token I've created. I've tried several different variations, but so far nothing has worked.

Here is an example of a url which works (with the username/password).

https://[our company account].atlassian.net/rest/api/2/search?jql=assignee=[my jira username]

Any thoughts?

[Rob Echlin · Accepted solution]

Hi Marvin, 

If you use the Jira Python library, just put the key where the password would go.

Example code (worked with the SAAS version of Jira, my user, my apikey)

#!/usr/bin/python3.6

# library modules
from jira import JIRA

user = 'me@here.com'
apikey = 'your0api0key0here'
server = 'https://SITE_NAME.atlassian.net'

options = {
 'server': server
}

jira = JIRA(options, basic_auth=(user,apikey) )

ticket = 'KRP-11697'
issue = jira.issue(ticket)

summary = issue.fields.summary

print('ticket: ', ticket, summary)

[Omantha Prasad]

Thank you for the answers, how can I get the users any sample python code to get user details who are in cloud Jira account?

[Dilip Arsid]

Thanks. This worked perfectly.

[Dominique Boutin]

Page for creating your tokens: 

https://id.atlassian.com/manage/api-tokens#

[John Gomez]

I was struggling with outh but this solution is easier. Thank you! 

[Ventsislav]

Can you authenticate for multiple servers in the same time? Something like

#!/usr/bin/python3.6

# library modules
from jira import JIRA

user = 'me@here.com'
apikey = 'your0api0key0here'
server1 = 'https://SITE_NAME1.atlassian.net'
server2 = 'https://SITE_NAME2.atlassian.net'

options = {
 'server': [server1, sever2]
}

jira = JIRA(options, basic_auth=(user,apikey) )

(Obviously if the user has access to both)

Is this even possible? Or is there a workaround so it is achievable?

[Purven Dudhaiya]

Can anyone help me out on how can I handle invalid username and password entered by the user. Thus, how can handle the calling of JIRA constructor using basic_auth but with wrong credentials ? ( not exception handling)

[Jose Luis Casarrubias]

I confirm the solution works fine!

[anunes]

@Rob Echlin Is it possible that the user isn't an email? I'm trying to authenticate using a an Organization Id and an API key, if not, as I assume it is because I have tried it. How does one fix this situation? https://support.atlassian.com/organization-administration/docs/manage-an-organization-with-the-admin-apis/  this was the guide used to create the API key in case it helps.

Thank you.

[John McGehee · Accepted solution]

Standing on the shoulders of @Rob Echlin the Giant, here is my version:

import jira

jira = jira.JIRA('https://example.atlassian.net', basic_auth=('username@example.com', 'usernames_api_key'))

# print all of the project keys as an example
for project in jira.projects():
    print(project.key)

[karim.belhadj]

Hello @John M 

it gives me this error : AttributeError: module 'jira' has no attribute 'JIRA'

Regards

Karim

[Emmanuel Mondragon]

Thanks Jhon McGehee.

[Oskar Austegard]

As mentioned here, should note that this is for Cloud only - Server & Datacenter use a different header (yay!):
https://github.com/pycontribs/jira/issues/993

Since the Python Jira API doesn't yet support personal access tokens directly, for Jira Server & Datacenter a workaround is in this thread:  
https://github.com/pycontribs/jira/issues/989#issuecomment-772683446

TL;DR:

host = "YOUR_JIRA_URL"
pat = "YOUR_PERSONAL_ACCESS_TOKEN"

headers = JIRA.DEFAULT_OPTIONS["headers"].copy()
headers["Authorization"] = f"Bearer {pat}"
jira=JIRA(server=host, options={"headers": headers})

[Deleted user]

Thanks @Oskar Austegard this worked for me. I have been trying to figure out the way to get the PAT working, and this was the only one that got it going. Kudos!

[Bill Sim]

Perfect @Oskar Austegard ! Nice work.

[Kurt Klinner · Accepted solution]

@Marvin Hoffman

We made some pretty good experiences with the jira python package 

https://jira.readthedocs.io/en/master/examples.html#oauth

http://blog.appliedinformaticsinc.com/how-to-get-authorize-and-request-access-token-for-jira/ might also be interesting

BR

Kurt

[Marvin Hoffman]

Thank you sir. I shall give this a go.

[Rob Echlin]

Hi Marvin, 

If you use the Jira Python library, just put the key where the password would go.

Example code (worked with my server, user, apikey)

#!/usr/bin/python3.6

# library modules
from jira import JIRA

user = 'me@here.com'
apikey = 'your0api0key0here'
server = 'https://SITE_NAME.atlassian.net'

options = {
 'server': server
}

jira = JIRA(options, basic_auth=(user,apikey) )

ticket = 'KRP-11697'
issue = jira.issue(ticket)

summary = issue.fields.summary

print('ticket: ', ticket, summary)

[John McGehee]

Standing on the shoulders of giant Rob, here is my version:

import jira

jira = jira.JIRA('https://example.atlassian.net', basic_auth=('username@example.com', 'usernames_api_key'))

# print all of the project keys as an example
for project in jira.projects():
    print(project.key)

[Jason Huang]

Hi @Andy Heinzer

This is for the cloud, doest there is also a way for Jira Server?

Thanks,

Jason

[Andy Heinzer]

Hi @Jason Huang at the time this was originally created, Jira Server did not have these kinds of tokens.  But in Jira server you could still use the username and password to manage authentication.

Jira 8.14 and higher though, do now have personal access tokens, which function in much of the same way as REST API tokens do in Jira Cloud today.

[Jason Huang]

Hi @Andy, thanks for your response.

I am trying the PAT, but encounter the websudo problem to create a user with the  python-jira package

Do you have any solution for it?

[Bill Sim]

Hey @Jason Huang see the post from @Oskar Austegard above .

[Colie Ryan]

To use python requests library and token (rather than the jira python library), this works for me:

headers = {

        "Accept": "application/json",

        "Content-Type": "application/json",

        "Authorization": "Bearer " + token

         }

r = requests.get(url, headers=headers, verify=False)

[Weronika Goracy]

Works for me! Thanks a lot!

[Sam Li]

Not working for me. I'm using v9.4.11

[Bill Sim]

There are a bunch of things that could be wrong... if you want help you need to pop in some more context... Are you running Cloud or DC? What is the error message if any? Are you using Requests (my assumption) or the JIRA module? What call are you making? Have you had any calls work? Etc...

[Sam Li]

Hi Bill thanks for the following up. Yes I should provide more context. We're not in cloud yet so it's DC. I do read the thread and the Jira document closely and try every senarios I can think of, including manually logon to disable captacha. The error messages I have imply authentication failure using PAK:

Response code: 400, Response contents: {"errorMessages":[],"errors":{"summary":"Field 'summary' cannot be set. It is not on the appropriate screen, or unknown.","description":"Field 'description' cannot be set. It is not on the appropriate screen, or unknown."}}

Jira issue creation failure: b'{"errorMessages":[],"errors":{"summary":"Field \'summary\' cannot be set. It is not on the appropriate screen, or unknown.","description":"Field \'description\' cannot be set. It is not on the appropriate screen, or unknown."}}'

Here is the python code partial that make the rest api call:

class JiraClient:

def __init__(self, env, file):

self.env = env

self.env_pattern = re.compile( r'^\<%= ENV\[\'(.*)\'\] %\>(.*)$' )

self.conf_dir = dirname(realpath(__file__)) + "/conf/"

if not is_directory(self.conf_dir):

 mkdir(self.conf_dir)

self.conf_file = file if file else self.conf_dir + "jira_integration.yaml"

self.conf_dict = self.load_yaml(self.conf_file)

self.jira_headers = {

"Accept": "application/json",

"Content-Type": "application/json",

"Authorization": "Bearer " + self.conf_dict[self.env]["api-token"]

 }

res = requests.post(self.conf_dict[self.env]['api-uri'] + '/issue/', \

headers=self.jira_headers, json=json_data, \

#auth=(self.conf_dict[self.env]['username'], \

#self.conf_dict[self.env]['password']), \

verify=False)

print(f'Response code: {res.status_code}, Response contents: {res.text}')

if res.status_code == 201:

print(f'Jira issue is sucessfully create: {res.status_code}')

else:

print(f'Jira issue creation failure: {res.content}')

return res.status_code

[Bill Sim]

Hi Sam,

No, that looks like you have successfully authenticated/authorized.

• To confirm I am right, always start with a read operation (GET) as that is less prone to configuration issues. Make sure the user can browse/view an issue. Then attempt to GET that issue via the API. If this works then it has nothing to do with your auth.
• The response above suggests that the user/token that is doing the API call cannot 'see' the fields on one of the screens required to carry out the call. Again, you can confirm this by making sure you can execute the operation you are trying manually as that user (after having logged into Jira as that user).

• Your auth header code looks fine to me.

• I've seen this type of error tonnes of times in the past, and it was always to do with the project/screen configuration or user authorisation at that point. Nothing do to with authentication. 

[Sam Li]

Hi Bill, thanks for the following up. This makes no sense to me - I don't understand what's the configurations could be wrong. The same code would work if I switch to the test user name and password, such as below:

res = requests.post(self.conf_dict[self.env]['api-uri'] + '/issue/', \

headers=self.jira_headers, json=json_data, \

auth=(self.conf_dict[self.env]['username'], \

self.conf_dict[self.env]['password']), \

verify=False)

Note the token is generated under the SAME test user. 

[Bill Sim]

• Did you try a read/get an issue request per my suggestion?
• The token above has never been used ("Last authenticated - Never") so that suggests that something is wrong with the request you're sending (contrary to what I said above)... so I'd check that the Authorization part of the header dict is indeed producing "Bearer TOKEN......." into the headers.

[Sam Li]

Thank you Bill. Yes you're right this time. It's the Jira headers problem. Somehow the code below did not work:

self.jira_headers = {

"Accept": "application/json",

"Content-Type": "application/json",

"Authorization": "Bearer " + self.conf_dict[self.env]["api-token"]

 }

Once I split the last line into 2 it works like a magic:

self.token = self.conf_dict[self.env]["api-token"]

self.jira_headers = {

"Accept": "application/json",

"Content-Type": "application/json",

"Authorization": "Bearer " + self.token

 }

[Bill Sim]

Good to hear!

[Andy Heinzer]

@Rob Echlin and @John McGehee Thanks for posting your own solutions to this post.  If you could repost these as an answer, instead of a comment, we could then accept your answer for this question.  It would help other users that come across this thread to see more clearly other potential solutions.  

I could post your answers again myself, but it feels super disingenuous to claim your solution as my own, which is how it would appear if I just copy/pasted it.

Thanks

Andy

[Rob Echlin]

Thanks for the suggestion.
I created an answer from my comment.

Sincerely,
Rob

[Andrew Sear]

The answers above seem to rely upon the jira pthon library, which is useful but then how do you place a REST query after authentication, e.g. request = "https://xx.atlassian.net/rest/agile/1.0/sprint/L8C_1.1"

for example, the library does not return the sprint report from JIRA cloud to my knowledge, or from JIRA server.

So my question is

1. how to authenticate for the requests libary with a JIRA token.

2. How to then place a query, and catch the response.

currently my approach is failing with "{"message":"Client must be authenticated to access this resource.","status-code":401}"

Regards

Andrew

[Rafe G]

Andrew,

I have the following python snippet that shows how to get the token into a base64 string, and then into the headers so that it can be used with requests:

import requests
import base64

user = 'user.email'
token = 'token.here'
url = 'URL_HERE'

auth = user + ":" + token
encoded = base64.b64encode(bytes(auth, "utf-8"))
encodedAuth = encoded.decode("utf-8")

headers = {
  "Accept":"application/json",
  "Content-Type":"application/json",
  "Authorization":"Bearer " + encodedAuth
}

r = requests.get(url, headers=headers)
print(r)

Rafer

[brian.zaranyika]

Hi Rafer thanks for this solution, quite helpful in solving this jira authentication error:

basic authentication with passwords is deprecated