Announcing the Connect app authorization guide

[zsims]

@jasonboileau

This is good stuff. I’d suggest also improving the workflow around adding new permissions to the app descriptor. As it is today, when a new permission is added, it requires admin approval (as should be). However, admins can hold off on upgrading indefinitely.

Thanks for the feedback. The re-consent from admins is important, especially as app scopes increase. Do you have ideas for how this approach can be improved from your point of view? We’ve discussed the concept of users “nudging” admins to perform the upgrade. It’s also come up with changes that require descriptor updates (like Action required: Atlassian Connect vulnerability allows bypass of app qsh verification via context JWTs).