03/05/2026, 12:47 Basic auth for REST APIs
Developer
Jira Cloud platform
Basic auth for REST APIs
ON THIS PAGE
Overview
Get an API token
Simple example
Supply basic auth headers
Advanced topics
This page shows you how REST clients can authenticate themselves using basic
authentication with an Atlassian account email address and API token .
Authentication using passwords has been deprecated.
Basic authentication is not as secure as other methods. We
recommend using it for simple scripts and manual calls to the REST
APIs. Otherwise, consider building an app:
Forge apps and Connect apps use more secure methods for
authentication: OAuth 2.0 and JWT respectively. In addition,
authentication is built into the app frameworks, so you don't
need to configure it. See Security for Forge apps and Security
for Connect apps.
OAuth 2.0 apps (integrations) created in the developer console
can use OAuth 2.0 authorization code grants (3LO), which is
also more secure than basic auth.
Overview
This site uses cookies to improve your browsing experience, perform
analytics and research, and conduct advertising. To change your
Manage preferences
preferences, click Manage preferences. Otherwise, clicking Accept all Reject all cookies
cookies indicates you agree
Important to our
notice foruse
appsof cookies
using 3LOon your device.
or API tokens
Clicking Reject all cookies means you do not agree to our use of
non-strictlyApps that collect
necessary cookiesAPIontokens or instruct
your device. customers
Atlassian Cookiesto create Accept all cookies
and Trackingindividual
Notice 3LO apps don't comply with our Security requirements for
cloud apps and Acceptable use policy .
Follow these best practices:
[Link] 1/4
03/05/2026, 12:47 Basic auth for REST APIs
Build a single, distributable 3LO app for your integration.
Clearly identify your app in the Marketplace (recommended).
Developer
Work with customers to transition away from custom 3LO apps
or API tokens.
Read our blog post for full details
The Jira REST API is protected by the same restrictions that apply in the
standard Jira web interface. These restrictions mean that if you don't log in, you
access Jira anonymously. If you log in and don't have permission to view
something in Jira, you won't be able to view it using the Jira REST API either.
In most cases, the first step in using the Jira REST API is to authenticate a user
account with your Jira site. This page provides a simple example of basic
authentication.
Get an API token
Basic auth requires API tokens. You generate an API token for your Atlassian
account and use it to authenticate anywhere where you would have used a
password. This enhances security because:
you're not saving your primary account password outside of where you
authenticate
you can quickly revoke individual API tokens on a per-use basis
API tokens will allow you to authenticate even if your Atlassian Cloud
organization has two-factor authentication or SAML enabled.
See the Atlassian Cloud Support API tokens article to discover how to
generate an API token.
Simple example
Most client software provides a simple mechanism for supplying a user name (in
our case, the email address) and API token that the client uses to build the
required authentication headers. For example, you can specify the -u
argument in cURL as follows:
1 curl -D- \
2 -u fred@[Link]:freds_api_token \
This site uses-Xcookies
GET \to improve your browsing experience, perform
analytics and research,
-H
and conductapplication/json"
"Content-Type:
advertising. To change
\ your
preferences, [Link]
click Manage preferences. Otherwise, clicking Accept all
cookies indicates you agree to our use of cookies on your device.
Clicking Reject all cookies means you do not agree to our use of
Supply basic auth headers
non-strictly necessary cookies on your device. Atlassian Cookies
and Tracking Notice
You can construct and send basic auth headers. To do this you perform the
following steps:
[Link] 2/4
03/05/2026, 12:47 Basic auth for REST APIs
1. Generate an API token for Jira using your Atlassian Account .
2. BuildDeveloper
a string of the form useremail:api_token .
3. BASE64 encode the string.
Linux/Unix/MacOS:
1 echo -n "user@[Link]:api_token_string" | base64
2
Windows 7 and later, using Microsoft Powershell:
1 $Text = ‘user@[Link]:api_token_string’
2 $Bytes = [[Link]]::[Link]($Text)
$EncodedText = [Convert]::ToBase64String($Bytes)
$EncodedText
4. Supply an Authorization header with content Basic followed by the
encoded string. For example, the string fred:fred encodes to
ZnJlZDpmcmVk in base64, so you would make the request as follows:
1 curl -D- \
2 -X GET \
-H "Authorization: Basic ZnJlZDpmcmVk" \
-H "Content-Type: application/json" \
"[Link]
Advanced topics
Authentication challenges
Because Jira permits a default level of access to anonymous users, it does not
supply an authentication challenge. Some HTTP clients expect to receive an
authentication challenge before they send an authorization header. This means
that a client may not behave as expected. In this case, configure the client to
supply the authorization header, as described above, rather than relying on its
default mechanism.
CAPTCHA
A CAPTCHA is 'triggered' after several consecutive failed log in attempts, and
Thisrequires
site usesthecookies
analytics and user totoand
research,
improve your
interpret
conduct
browsingpicture
a distorted
advertising.
experience,
To of a word
change
perform
your and type that word
into a textclick
preferences, fieldManage
with each subsequent
preferences. log in attempt.
Otherwise, clicking IfAccept
CAPTCHAallthehas been
triggered, you cannot use Jira's REST API to authenticate
cookies indicates you agree to our use of cookies on your device. with Jira site.
You canReject
Clicking checkall this in themeans
cookies erroryou
response
do notfrom
agreeJira. If there
to our use ofis an X-Seraph-
non-strictly
LoginReason header
necessary with on
cookies a value
your ofdevice. Atlassian Cookies
AUTHENTICATION_DENIED , the
andapplication
Tracking Notice
rejected the login without even checking the password. This is the
most common indication that Jira's CAPTCHA feature has been triggered.
[Link] 3/4
03/05/2026, 12:47 Basic auth for REST APIs
Rate this page:
Developer
Changelog
System status
Privacy
Your Privacy Choices
Developer Terms
Trademark
© 2026 Atlassian
This site uses cookies to improve your browsing experience, perform
analytics and research, and conduct advertising. To change your
preferences, click Manage preferences. Otherwise, clicking Accept all
cookies indicates you agree to our use of cookies on your device.
Clicking Reject all cookies means you do not agree to our use of
non-strictly necessary cookies on your device. Atlassian Cookies
and Tracking Notice
[Link] 4/4