API tokens without scopes are being "deprecated"

[Thomascountz]

This banner recently appeared on the API creation page (linked to from the README), but there doesn't appear to be any other public announcement, see: https://community.developer.atlassian.com/t/api-tokens-without-scopes-are-being-deprecated/92510

That said, I think it would be good to recommend users create tokens with scopes.

I wonder if any of the classic scopes would be sufficient. There are over 150 fine-grained scopes for Jira alone.

[peter-xsolla]

I set this up a couple weeks ago at a new job and I tried to create a scoped token with a couple of different classic scopes. (edit repo, something else) and they failed. I eventually reverted to an unscoped token which works. It would be good to figure out a working scope set. There should be a documentation bug once this is done to update the install instructions to use a new scoped token. The developer docs should also push to use a scoped token so when someone needs more permission they hit the issue and update things accordingly.

[arborluke]

Did you manage to crack this? We are discovering the exact same problem

[ErikBrendel]

In my experience, the problem is actually just the base URL. Atlassian's "API tokens with scopes" only work against the OAuth gateway https://api.atlassian.com/ex/jira/{cloudId}/..., not the direct https://<your-site>.atlassian.net/rest/... path that jira-cli talks to by default. On the direct path a scoped token authenticates but behaves bizarrely: generic search returns 200 with an empty result set, issue-by-key returns 404 ("does not exist or you do not have permission"), and /myself returns 401 — which looks exactly like a permissions/scope problem but isn't.

The fix: point jira-cli's server at the gateway instead of your site. Get your cloud ID from https://<your-site>.atlassian.net/_edge/tenant_info (the cloudId field), then:

  jira init \                                                                                                                                                                                                                               
    --installation cloud \                                                                                                                                                                                                                  
    --server https://api.atlassian.com/ex/jira/<your-cloud-id> \                                                                                                                                                                            
    --login you@example.com \                                                                                                                                                                                                               
    --force

li builds request URLs as {server}/rest/api/3/..., so a gateway server yields the correct https://api.atlassian.com/ex/jira/<cloudId>/rest/api/3/... with basic auth (email:token). Verified working with a scoped token this way.