# OAuth2.0 for Jira REST API with Azure AD as Identity Provider **URL:** \ **Category:** Jira Cloud\ **Tags:** oauth2, auth, refresh-token, client-credentials-grant-type\ **Created:** [September 6, 2021, 8:07am UTC](https://community.developer.atlassian.com/t/oauth2-0-for-jira-rest-api-with-azure-ad-as-identity-provider/51701 "2021-09-06T08:07:19Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![MuthurajArunKumar](https://avatars.discourse-cdn.com/v4/letter/m/aca169/32.png) [@MuthurajArunKumar](https://community.developer.atlassian.com/u/MuthurajArunKumar)\ **Post date:** [September 6, 2021, 8:07am UTC](https://community.developer.atlassian.com/t/oauth2-0-for-jira-rest-api-with-azure-ad-as-identity-provider/51701/1 "2021-09-06T08:07:19Z")
Hi All, Jira cloud in my organisation authenticates users via Azure AD SSO. As a first step in Jira OAuth2.0, I need code(grant type - code flow) for accessing token. However, for retrieving code, I have to authenticate with username & password via Azure AD for progressing with OAuth which become tedious and redundant process for automation script/webservice client. Moreover, I feel purpose of OAuth for an automation script/service client has not been fulfilled. Wondering, if Atlassian supports `client_credentials` grant type for communication b/w Jira and a machine? Can someone guide me to resolve this issue? ---
**Author:** ![ibuchanan](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/ibuchanan/32/35815_2.png) [@ibuchanan](https://community.developer.atlassian.com/u/ibuchanan)\ **Post date:** [September 7, 2021, 11:26am UTC](https://community.developer.atlassian.com/t/oauth2-0-for-jira-rest-api-with-azure-ad-as-identity-provider/51701/2 "2021-09-07T11:26:59Z")
Welcome to the Atlassian developer community @MuthurajArunKumar, The short answer is yes, but for a very limited set of APIs. Specifically, [the `client_credentials` grant](https://developer.atlassian.com/cloud/jira/software/integrate-jsw-cloud-with-onpremises-tools/) is only available for the [builds API](https://developer.atlassian.com/cloud/jira/software/rest/#api-group-Builds), [deployments API](https://developer.atlassian.com/cloud/jira/software/rest/#api-group-Deployments), [development information API](https://developer.atlassian.com/cloud/jira/software/rest/#api-group-Development-Information), and [feature flags API](https://developer.atlassian.com/cloud/jira/software/rest/#api-group-Feature-Flags). You said the process is “tedious and redundant”, which make me wonder if you were aware that user authorization is only needed once if your client can remember a [refresh token](https://developer.atlassian.com/cloud/jira/platform/oauth-2-3lo-apps/#how-do-i-get-a-new-access-token--if-my-access-token-expires-or-is-revoked-). Otherwise, can you explain more about why the `client_credentials` grant type is needed for your scenario? ---
**Author:** ![MuthurajArunKumar](https://avatars.discourse-cdn.com/v4/letter/m/aca169/32.png) [@MuthurajArunKumar](https://community.developer.atlassian.com/u/MuthurajArunKumar)\ **Post date:** [September 8, 2021, 1:50am UTC](https://community.developer.atlassian.com/t/oauth2-0-for-jira-rest-api-with-azure-ad-as-identity-provider/51701/3 "2021-09-08T01:50:25Z")
@ibuchanan Thanks for the suggestion. Refresh token works for our scenario however my team missed it because it was FAQ rather than being part of the authorization flow. [https://developer.atlassian.com/cloud/jira/platform/oauth-2-3lo-apps/#faq1](https://developer.atlassian.com/cloud/jira/platform/oauth-2-3lo-apps/#faq1) ---
**Author:** ![MuthurajArunKumar](https://avatars.discourse-cdn.com/v4/letter/m/aca169/32.png) [@MuthurajArunKumar](https://community.developer.atlassian.com/u/MuthurajArunKumar)\ **Post date:** [September 13, 2021, 8:23am UTC](https://community.developer.atlassian.com/t/oauth2-0-for-jira-rest-api-with-azure-ad-as-identity-provider/51701/4 "2021-09-13T08:23:08Z")
@ibuchanan I would like to check a strange behaviour that our team observed while using refresh token API, **Correct Scenario** - Working as expected 1. Make a post call for fetching refresh and access token 2. Make a post call for Jira REST API using access token 3. Once access token expires then again make call for new refresh token & access token by sending the refresh token obtained from step 1 response **Wrong Scenario** - step 1 & step 2 are same as correct scenario 3. Once access token expires then again I mistakenly made a post call using old refresh token as in step 1 request rather than response which eventually forces me to start from code authorisation flow however, this is not the case for empty or incorrect refresh token where I was able to use refresh token available from step 1 response again to get new refresh and access token. Error response with code 403 { “error”: “invalid\_grant”, “error\_description”: “Unknown or invalid refresh token.” } Can I know, if it is expected behaviour or a bug when I accidentally make a call for using last used refresh token? ---
**Author:** ![ibuchanan](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/ibuchanan/32/35815_2.png) [@ibuchanan](https://community.developer.atlassian.com/u/ibuchanan)\ **Post date:** [September 28, 2021, 12:27am UTC](https://community.developer.atlassian.com/t/oauth2-0-for-jira-rest-api-with-azure-ad-as-identity-provider/51701/5 "2021-09-28T00:27:14Z")
@MuthurajArunKumar, I think the same question was answered here: > [@Superseded: 31 January 2022 - Action required - Deprecating persistent refresh tokens](https://community.developer.atlassian.com/t/superseded-31-january-2022-action-required-deprecating-persistent-refresh-tokens/50348/11): > > The behaviour you are describing at first scenario is because of [automatic reuse detection](https://auth0.com/docs/security/tokens/refresh-tokens/refresh-token-rotation#automatic-reuse-detection). Once you get a NEW\_REFRESH\_TOKEN (rotating), any usage of an earlier refresh token will be considered as a lost/stolen refresh token. Hence to prevent such malicious attack both the refresh tokens are invalidated and user is forced to re-consent. In short, expected behavior. ---
**Author:** ![MuthurajArunKumar](https://avatars.discourse-cdn.com/v4/letter/m/aca169/32.png) [@MuthurajArunKumar](https://community.developer.atlassian.com/u/MuthurajArunKumar)\ **Post date:** [September 28, 2021, 1:29am UTC](https://community.developer.atlassian.com/t/oauth2-0-for-jira-rest-api-with-azure-ad-as-identity-provider/51701/6 "2021-09-28T01:29:57Z")
Thanks 🙂