Action Required: Deprecating support for passing Connect JWTs as a query string parameter to Atlassian APIs

[zsims]

@remie

There is currently no API for this, so the only way for Connect apps to do this is to do a GET request to /secure/attachments/{id} with the JWT as a query string parameter.

Good point! There’s a new API that went out for Confluence last week: New Download attachment REST API endpoint

For the existing API, the recommended approach is:

• If your app server needs the attachment, specify the JWT via header; or
• If the end user needs the attachment, rely on session authentication. E.g. redirect them to https://<site>.atlassian.net/secure/attachments/... if they’re logged in, the attachment will download.