Make your first impression work harder.

Bearer service key with object-specific read/write scopes, created by a Super Admin or a user with Developer tools access. A developer-platform app with static or OAuth access is another route. Use scopes and CRM objects available in the customer's account. Service keys make REST requests but cannot authenticate webhooks. Existing legacy private apps remain supported; creating a new legacy private app ended October 26, 2026. Use the current service-key or developer-platform flow.

HTTP Basic authentication over HTTPS with the account's numeric User ID and API key; OAuth is available for an app connecting multiple accounts. Calls must run server-side. Official help lists API access on Premium or Powerhouse plans. Calendar and appointment-type configuration must already exist. Keep normal client validation enabled: admin=true bypasses availability and attribute checks.

OAuth 2.0 authorization-code grant for a distributed integration; ad-hoc scripts can use basic authentication with the documented API-token setup. Endpoint scopes and the acting user's service-desk permissions both apply. The customer needs an accessible Jira Service Management service desk with a configured request type and required fields. Raising requests for someone else, viewing restricted issues and reading SLAs require the corresponding user/agent rights. API documentation does not itself establish the customer's subscription entitlements.