Last year, we posted RFC-89 introducing OAuth 2.0 three-legged-OAuth(3LO) for Trello (referred to as OAuth 2.0 in this post). The feedback in that thread was detailed and really valuable, and shaped how we’re approaching this rollout. A few things you told us: don’t force developers to adopt OAuth 2.0 before they’re ready, don’t deprecate API tokens, and give developers enough time and tooling before anything changes.
Today I’m happy to share that today OAuth 2.0 is now available for Trello apps. If you’re building a new app, you can opt in right away and transition existing apps when ready. You can also continue using our current protocol. Both OAuth 2.0 and our current protocol remain fully supported today.
OAuth 2.0 is the right choice for user-facing apps, where a person logs in and consents to access. If that describes your app, we recommend it. If your app runs without a logged-in user (bots, automations, server-to-server integrations) OAuth 2.0 3LO isn’t built for that, and API tokens remain your best option. We encourage developers using our current authorization protocol to review the documentation and consider what transitioning may look like.
OAuth 2.0 offers important improvements for users and developers:
-
Scoped permissions let you request only the access your app needs.
-
Short-lived tokens with Proof Key for Code Exchange (PKCE) reduce exposure if a token is ever compromised.
-
Resource restrictions scope Power-Ups to a single workspace, while integrations can request broader access, with clear consent messaging.
-
A redesigned consent screen gives users full transparency into what data your app accesses, consistent with what they see across other Atlassian products.
The updated Developer Portal now includes an OAuth 2.0 page where you can configure client settings, select granular scopes, choose between public or confidential client security, and preview a sample authorization URL to get started quickly.
The team is excited about OAuth 2.0 rolling out, but I want to reiterate that API tokens are not going away. Trello Auth and OAuth 2.0 are both options for you right now. There’s no deprecation timeline, and we won’t set one until critical use cases like server-to-server integrations, bots, and unattended processes have a secure, supported alternative. We do recommend that new apps use OAuth 2.0 to avoid transitioning to a new authorization protocol in the future.
If you’re ready to start building with OAuth 2.0, head over to Trello’s OAuth 2.0 developer guides to get started. I’ve added some additional FAQs below to cover a few other topics as well. We also want to say thank you for building with Trello. We appreciate you sharing your experiences and feedback, and helping make OAuth 2.0 for Trello the best it can be.
FAQs
Q: Which exact grant types will be supported via OAuth 2.0?
A: Trello is introducing support for authorization_code and refresh_token grant types (sometimes referred to as three-legged OAuth or OAuth 2.0 3LO). We won’t be supporting grant types like client credentials. This means OAuth 2.0 may not support all developer use cases, and some apps won’t be able to transition today. We’re working on alternative authorization types to cover these cases.
Q: OAuth 2.0 requires rotating refresh tokens every 90 days. How do I handle that in a production environment?
A: Refresh token rotation is a security best practice designed to detect and limit the impact of token theft. If a refresh token is used more than once, the system can detect a potential breach. For production environments, we recommend storing refresh tokens in a secure identity manager (like AWS Secrets Manager, Azure Key Vault, or HashiCorp Vault) that can handle token refresh automatically.
We acknowledge that this adds some operational complexity, particularly for long-running server processes. If your use case requires long-lived unattended access, API tokens are still supported today, and future authorization types will address this use case.
Q: Who can I contact if I still have questions?
A: You can open a support ticket with our dedicated developer support team via Atlassian Developer and Marketplace Support.
