For a script or manual call to Jira Cloud’s Automation REST API, authenticate with an Atlassian account email and API token using HTTP Basic authentication. That proves who is making the request; it does not grant access to every endpoint. The account also needs the permissions required for the specific Automation operation.
Choose the authentication method for your client
Atlassian documents API-token Basic authentication for Automation REST API requests. A browser session cookie is supported for some calls, but only through the site gateway path. These methods apply to a client calling the Automation API; OAuth used by an Automation rule to call an outside service is a separate flow.
As an Amazon Associate I earn from qualifying purchases.
| Use case | Authentication or authorization approach | Important distinction |
|---|---|---|
| Script or manual REST client | Atlassian account email and API token in HTTP Basic authentication | Use a token, not the account password. Atlassian describes this method for simple scripts and manual calls. Atlassian Basic auth guidance |
| Supported browser-originated call | Browser session cookie through the site gateway base path | The session-cookie option is not the documented authentication method for the api.atlassian.com base path. Automation API paths |
| Forge or OAuth 2.0 authorization-code app | App scopes appropriate to the operation, together with the user’s Jira permissions | Scopes do not override the user’s Jira permissions, and the Jira scope guide is not an endpoint-by-endpoint Automation scope map. Jira scopes for OAuth 2.0 and Forge |
| Automation rule calling an external OAuth-protected service | Obtain an access token, then send it as a Bearer token in the subsequent outgoing request | This authenticates the rule to the external service, not a client to the Automation REST API. Atlassian Support: outgoing OAuth web requests |
Authenticate a script or manual API call
- Create an API token. Create it for the Atlassian account that will make the request. Atlassian API tokens are used instead of the account password and can be revoked. See Atlassian Automation authentication.
- Build the Basic-auth credential. Join the account email and token with a colon:
<email>:<token>. Base64-encode the complete string, then send it in the request header asAuthorization: Basic <encoded-credential>. Do not send the account password in place of the token. - Choose the documented base path. Use the API path for your client and site, as described below.
- Call the documented endpoint. Use its required HTTP method and full path, including the API version specified in the route. The Automation REST reference describes the available operations.
Use the correct base path
| Base path | Supported authentication noted by Atlassian |
|---|---|
https://api.atlassian.com/automation/public/{product}/{cloudid} |
API token |
https://{sitename}/gateway/api/automation/public/{product}/{cloudid} |
API token or browser session cookie |
Replace {product} with the product being called, such as jira, and {cloudid} with the ID of the Atlassian Cloud site. Atlassian documents https://{sitename}/_edge/tenant_info as a way to find the cloud ID. See the base-path reference for path details.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteGrant the permissions required by the endpoint
Authentication identifies the caller; authorization determines whether that caller may perform the requested operation. Atlassian says Automation API authorization is based on the user’s access in the product being invoked. The required access varies by endpoint: many operations require site- or container-level administrator access, while others check permissions on the particular object involved. There is no safe universal role to assume for every Automation API call.
#1 Best Overall
Before changing credentials, open the exact endpoint’s documentation and check its authorization requirements. Then verify the calling account’s access to the relevant Jira site, container, product, or object. The general Automation authorization guidance explains the distinction; the REST reference provides the operation-specific context.
For Forge and OAuth 2.0 apps
Choose scopes for the operations the app performs, but do not treat a scope as a permission grant to the user’s Jira data. Jira permissions continue to apply: for example, an app scope cannot give a user access to project data if that user lacks Browse projects permission. Atlassian’s Jira scope guide covers general Jira Cloud scopes; it does not, by itself, establish which scope is sufficient for every Automation endpoint. Confirm the requirements for the exact endpoint in its API reference.
Rank #2
Keep outgoing rule authentication separate
If a Jira Automation rule makes a web request to an external OAuth-protected service, Atlassian Support describes a two-request pattern: first obtain an access token, then include it in the next request’s Authorization header as a Bearer token. A rule can use a value from the token response, for example Bearer {{webhookResponse.body.access_token}}, when configuring the later request.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Atlassian also warns that values in the webhook body are sent without HTML URL encoding. Special characters are passed as-is, so an authentication request may fail unless values needing encoding are handled appropriately. This pattern concerns a rule authenticating to an external service; it is not the credential scheme for a script calling the Automation REST API. See Atlassian’s outgoing web-request guidance.
Quick Recap
Rank #4
- Used Book in Good Condition
Troubleshoot an authenticated request that is denied
- Confirm the base path and client type. Check whether the request uses
api.atlassian.comor the site gateway, and whether its authentication method is supported on that path. - Check the credential format. For Basic auth, use the Atlassian account email and API token joined with a colon, then Base64-encode that full string. An account password is not a substitute for an API token.
- Check the exact operation’s access rules. Verify whether it requires an administrator role or access to a specific container or object, then confirm that the calling user has it.
- Check app scopes and user access separately. For Forge or OAuth 2.0 apps, confirm both that the scopes fit the operation and that the user already has the necessary Jira permissions.
- Verify the route. Check the HTTP method, endpoint path, product segment, cloud ID, and API version against the REST reference.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
