# Using Automation REST API with OAuth token

**URL:** <https://community.developer.atlassian.com/t/using-automation-rest-api-with-oauth-token/90125>\
**Category:** Atlassian Developer Tools\
**Tags:** automation, automation-rules, rest-api\
**Created:** [March 11, 2025, 7:39pm UTC](https://community.developer.atlassian.com/t/using-automation-rest-api-with-oauth-token/90125 "2025-03-11T19:39:40Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![RyanHolstad](https://avatars.discourse-cdn.com/v4/letter/r/b9e5f3/32.png) [@RyanHolstad](https://community.developer.atlassian.com/u/RyanHolstad)\
**Post date:** [March 11, 2025, 7:39pm UTC](https://community.developer.atlassian.com/t/using-automation-rest-api-with-oauth-token/90125/1 "2025-03-11T19:39:40Z")

</div>

I already have a 3LO app allowing users to create new issues. I would like to add the ability for users to manually run an automation rule. I have found the Automation REST API ([https://developer.atlassian.com/cloud/automation/rest](https://developer.atlassian.com/cloud/automation/rest)), but it does not support authentication with OAuth token. I also do not see a way to create API Tokens via the Jira REST API. I cannot require users to sign into their account and create an API token to use this feature.

---

<div class="post-metadata">

**Author:** ![anon96974232](https://avatars.discourse-cdn.com/v4/letter/a/7ba0ec/32.png) [@anon96974232](https://community.developer.atlassian.com/u/anon96974232)\
**Post date:** [March 11, 2025, 8:40pm UTC](https://community.developer.atlassian.com/t/using-automation-rest-api-with-oauth-token/90125/2 "2025-03-11T20:40:44Z")

</div>

Hello @RyanHolstad

There is no way to use Jira’s REST API to create Basic tokens or browser session cookies, so if you cannot get the user to provide your app with their API token, then your app will not be use the Automation API.

---

<div class="post-metadata">

**Author:** ![RyanHolstad](https://avatars.discourse-cdn.com/v4/letter/r/b9e5f3/32.png) [@RyanHolstad](https://community.developer.atlassian.com/u/RyanHolstad)\
**Post date:** [March 11, 2025, 8:53pm UTC](https://community.developer.atlassian.com/t/using-automation-rest-api-with-oauth-token/90125/3 "2025-03-11T20:53:53Z")

</div>

Are you able to speak to why the Automation API doesn’t support OAuth or whether it may in the future? Or is there any other API which supports OAuth for manually triggering an automation rule?

---

<div class="post-metadata">

**Author:** ![anon96974232](https://avatars.discourse-cdn.com/v4/letter/a/7ba0ec/32.png) [@anon96974232](https://community.developer.atlassian.com/u/anon96974232)\
**Post date:** [March 11, 2025, 9:06pm UTC](https://community.developer.atlassian.com/t/using-automation-rest-api-with-oauth-token/90125/4 "2025-03-11T21:06:00Z")

</div>

My guess is that because OAuth opens the path for triggering actions that don’t originate from a user account or can be done without their individual consent, and since the manual triggering of an automation rule must be done exclusively by a user, which directly infers their consent, Atlassian probably just don’t want that basic logic rule to be broken.

Secondly, Atlassian probably also don’t want people building apps that could mass trigger automations manually, thereby replicating the existing automation scheduling system, thereby creating large loads on their systems. They probably want to keep the manually triggering of automation as a ‘special case’ that only individual users can do, or their individual API tokens can do, and thereby be constrained by the GUI or existing personal API access limits.

---

<div class="post-metadata">

**Author:** ![JPComeau](https://avatars.discourse-cdn.com/v4/letter/j/edb3f5/32.png) [@JPComeau](https://community.developer.atlassian.com/u/JPComeau)\
**Post date:** [August 5, 2025, 7:51pm UTC](https://community.developer.atlassian.com/t/using-automation-rest-api-with-oauth-token/90125/5 "2025-08-05T19:51:12Z")

</div>

That makes sense, but having the ability to at least list out the automations would be super valuable. Maybe it’s about making some endpoints available through OAuth and others not?
