Forge Remote – Offline User Impersonation returns “No Atlassian OAuth token found for this user and extension” even after user interaction

Forge
, ,
1

Hi everyone,

I’m currently implementing Forge Remote with offline user impersonation, but I’m consistently hitting the following error:

**No Atlassian OAuth token found for this user and extension
**
I’ve already followed the official docs:

Flow:

  1. Backend calls Forge webtrigger

  2. Forge callback remote backend with:

    • Authorization: Bearer <FIT>

    • x-forge-oauth-system

  3. Backend:

    • decodes FIT → extracts cloudId + apiBaseUrl

    • calls GraphQL offlineUserAuthToken

    • uses returned token to call Jira REST API

GraphQL Request:

mutation GetUserToken($input: OfflineUserAuthTokenInput!) {
  offlineUserAuthToken(input: $input) {
    success
    authToken {
      token
      ttl
    }
    errors {
      message
	  extensions {
        errorType
      }
    }
  }
}

Manifest:

permissions:
  scopes:
    read:app-system-token: {}
    read:jira-user:
      allowImpersonation: true
    read:jira-work:
      allowImpersonation: true
    write:jira-work:
      allowImpersonation: true
    manage:jira-configuration: {}
    read:email-address:jira: {}
    storage:app: {}

What I’ve verified

  • FIT token is valid and decoded correctly

  • x-forge-oauth-system token is present and used for GraphQL

  • cloudId and apiBaseUrl are correct from FIT

  • GraphQL query structure is valid (no validation errors)

  • Users exist in Jira and accountId is correct

  • Users are added as Forge app contributors

  • App is deployed and upgraded (forge deploy, forge install --upgrade)

  • Tested with:

    • app owner

    • contributor users

  • Added a jira:adminPage module and opened it as the user (to establish app context)

GraphQL consistently returns:

{
  "success": false,
  "authToken": null,
  "errors": [
    {
      "message": "No Atlassian OAuth token found for this user and extension",
      "extensions":[
         {
          "errorType":"MISSING_USER_CONSENT"
         }
       ]
    }
  ]
}

My questions is:

  1. Is there an additional step required to establish a user ↔ app OAuth relationship for Forge Remote impersonation?
  2. Does offline impersonation require:

    • Marketplace distribution, or

    • Direct distribution
      for user tokens to be issued (beyond contributors)?

  3. Does invoking from a webtrigger module affect the ability to generate offline user tokens?
  4. Is there any requirement for:

    • asUser() invocation prior to remote calls, or

    • specific module types (UI vs webtrigger) to enable user token issuance?

My goal is Backend → Forge → Jira (comment as real user) but currently limited to asApp() behavior.

Any clarification or guidance would be really appreciated.
Happy to provide logs or additional details if needed.

Thanks! :folded_hands:

2

Any update on this?

I encountered this problem when trying to retrieve offline user impersonation tokens for any user other than my own account ID.

The problem seemed to be on a local dev Forge app, DEVELOPMENT environment, and distribution > sharing disabled. I could access offline impersonation tokens for my user account, but any other atlassian account type would fail with:

No Atlassian OAuth token found for this user and extension

and

"extensions" : {
  "errorType" : "MISSING_USER_CONSENT"
}

User consent for other account users on a local development app that can’t enable sharing seems like an oversight here, especially in our case when the app has no Forge UI modules at this time.

3

Hey Denny, I tried every support and forum there is but so far no luck :thinking: , I have decided to go with Oauth2.0 3LO at the moment.

4

Thanks for clarifying!

My alternative was to recreate a new local developer app and enable sharing on that. Of course, public marketplace apps tied to a Connect key do not have this option, so we can only hope that once deployed through to our Production environment that it works!

5

Hi

To use offline user impersonation you must add the user(email) you want to impersonate, as viewer to the Forge app you use.

When you do that, an email will be send to the user.

I have implemented user impersonation logic: Forge + backend for our company custom Mail handler and in that way the app can create or comment on behalf of other users.