I want to publish an OAuth2 app to allow users to give OAuth2 access token to us and then create, update, & retrieve Jira tickets based on their permissions.
For enterprise users, we want them to have org/site level control on whether they can enable this feature or not.
I tried creating a private app on Marketplace and didn’t see an option to generate client_id and client_secret for that app. I’m guessing that it’s through developer console but not sure how the developer app links to Marketplace app. Can someone clarify this ??
Secondly, the OAuth2 documentation says that “Although OAuth 2.0 (3LO) apps can be listed on the Atlassian Marketplace, they will appear as informational listings only, with limited Marketplace features”. If the Marketplace app is just informational, does it still allows Jira admins with the option to enable this app only for some orgs/sites ?
Thirdly, what’s the recommended way of regionalizing this app, should I create different apps on developer console for each region e.g. Prod US and Prod EU that has different callback urls for different regions or have a single app with multiple callback urls ??
Welcome to the Atlassian developer community @AnkurSethi,
Can we back up from the technical so I can understand why you are trying to do this manipulation of client id and secrets? Because, on the face of it, we don’t want apps to do what you’ve asked. The following blog post expresses the overall sentiment:
Namely, we don’t want vendors to be storing client id & secret created by customers (or, in your case for customers). And this should not be necessary for OAuth apps typically.
@AnkurSethi – There’s a lot to unpack here, but I’ll give it my best:
You’re correct that the Client ID and Secret are generated in the Developer Console rather than the Marketplace. You can find these under Settings inside your app’s profile of the Developer Console.
My understanding is that they don’t technically link at all. You’ll just have a URL in the marketplace listing that directs the user to wherever they need to go to get your app. (Sales page, landing page, install page, etc.)
You’ll probably need to design mechanisms inside your app to help enforce administrative approval. (Unless Atlassian Guard or something provides this control.)
I don’t know what’s “recommended”, but I assume multiple callback URLs is the easiest solution, provided that your app can intelligently select the correct callback when generating the authorization URL.
I may have misunderstood the intent (there were a lot of questions to untangle), but I think the OP is just trying to generate the app’s Client ID and secret.
@AaronMorris1 You got the gist of what I am trying to do. Thanks for clarifying.
Based on your answers, Marketplace app and developer app are mostly decoupled from each other. It’s disappointing that there are no Jira admin controls to allowlist a particular app for an org/site.
