personalAccessToken not working as described

[uncaught]

I'm totally new to jira and their API, so please forgive if this is obvious to you.

I've installed and set up my client as such according to your documentation:

const jira = new Version3Client({
  authentication: {
    personalAccessToken: process.env.JIRA_TOKEN || '',
  },
  host: 'https://my-domain.atlassian.net',
});

But that yields this response:

 response: {
    code: 'ERR_BAD_REQUEST',
    message: 'Request failed with status code 403',
    data: { error: 'Failed to parse Connect Session Auth Token' },
    status: 403,
    statusText: 'Forbidden'
  },

Using the same token and the basic authentication, it works:

const jira = new Version3Client({
  authentication: {
    basic: {
      apiToken: process.env.JIRA_TOKEN || '',
      email: 'my-name@my-domain.com',
    },
  },
  host: 'https://my-domain.atlassian.net',
});

So is your documentation wrong here? Or your implementation? Or maybe personal access tokens don't exist anymore because Jira calls them API tokens on the referenced page?

[nessgor]

The link in the documentation points to API Token, not Personal Access Token. According to this page

Before you begin
You can create and use personal access tokens in Data Center and Server editions of the following Atlassian applications:

• Jira Core 8.14 and later
• Jira Software 8.14 and later
• Jira Service Management 4.15 and later
• Confluence 7.9 and later

In Jira, select your profile picture at the top right of the screen, then select Profile. Once you access your profile, select Personal Access Tokens in the left-hand menu.

It explicitly stated Data Center and Server editions, so I am unsure if we can create a PAT on the Jira Cloud edition. And yes, we should fix the link in the documentation. It is misleading.

[MrRefactoring]

1. Clarify the use of Personal Access Token (PAT):
   I don’t quite remember why I introduced PAT authentication, but it seems it doesn’t apply to the Jira Cloud API. Regarding the documentation, I mistakenly linked the apiTokens release instead of personalAccessToken. I suggest moving the link to the basic authentication documentation section.

2. Evaluate the need for PAT:
   We should determine if PAT is still necessary. If not, it should be marked as deprecated and removed in future releases.

3. Investigate email + password authentication:
   We need to verify if email + password authentication is still supported for API access. It seems this method has been unavailable for a long time.

[MrRefactoring]

Let’s address step 1 (see my comment above) as part of the v4.1.0 release. We’ll leave the remaining steps for further investigation and prioritize their implementation in the future