Do I really need to list my OAuth 2.0 (3LO) app on Marketplace to share with other people?

I get asked many variations of this question, “I don’t want to make my OAuth 2.0 app public (via Marketplace), but I do want other people to use it. How do I share my app?” Overall, I’m the first to complain that the overall structure of having all that tutorial, guidance, and reference on a single page is quite cumbersome. But I think people get confused most on the section about distributing apps. After explaining how to share an app, it also adds:

  • OAuth 2.0 (3LO) apps are installed on a per-user basis, so you’ll have to send the link to all the users you want to grant access to.

That could be confusing because “the link” is a bit vague. Usually in OAuth 2.0, the authorization URL is embedded in an overall web flow. So that link is already shared through your web application. It is not necessary to share it on Marketplace. Which is also explained in the documentation:

Let’s walk through this. If you have just created your OAuth 2.0 app in the developer console, then, by default, it is in developer mode. And it will only work for you, as the creator of that app. When you use the authorization URL in your browser, then you will see a warning about being in developer mode (see the yellow box below):

The same authorization URL will not work for anyone else, even if they are in the same site as you. So, to share with other people, regardless of same site or different, you will have to turn on “distribution” in the developer console:

That notion of distribution is separate from Marketplace. If you do want to get listed on Marketplace, you have to go through a separate process.

Hope that helps.

7 Likes

Hello,
Your answer here is so clear, thank you very much.
What remains unclear to me is this : Vendor name and Privacy Policy fields are mandatory, but I don’t really know what info I have to put there ? Are this fields related to my company, or related to the application I am connecting to Jira ?
Have a nice day,
Best regards !

2 Likes

Welcome to the Atlassian developer community @Anne-Charlotte,

Good questions, especially if you aren’t planning to list on Marketplace. I don’t think there are any consequences of these values, so almost anything will do just to satisfy the required field. That said, I worry that we might change things later and that could lead to some confusion if Atlassian started to post messages that read, “Do you trust this app from anyone with privacy policy none at all.” So maybe some semi-reasonable values like your own company name and URL to your company’s privacy policy (or maybe just a link to your corporate web site).

3 Likes

Hi,
Thank you for your warm welcome , and for your precious help.

Have a nice day !