I’d like to develop an integration app to sync data between a system I maintain and our clients’ JIRA instances. I assume the JIRA rest api and webhooks will be enough to support my data update needs, but I’m unsure about the authentication options and implications of the different app types.
I’ve read the development platform overview. I don’t need a UI within JIRA, so an OAuth 2 ‘app’ seems most appropriate and a forge or connect app seems like overkill.
However, oauth-2-apps seem to have a couple of drawbacks for my scenario:
- They’re installed/authenticated per user, so access may be limited and all updates the integration performed would be done by that user. (We don’t have all the same users in both systems, I prefer the model of the app itself being a user as described in security for connect apps.)
- Even with a periodic renewal of the refresh token it will still require manual re-authentication every year
Do I understand those drawbacks correctly?
If I decide to create a forge or connect app instead, are either of those platforms better for my scenario?
I know Atlassian are trying to move towards forge, but it seems like connect is a better fit for my scenario. If I did create a forge app, are there any built-in auth mechanisms for calling an external API or receiving callbacks as a service/app? (I know forge supports external authentication as a user with the auth code flow, but I guess I’d have to manually store/use an api key or oauth client secret. Connect’s JWTs seem like they do some/most of that out of the box.)