ST-2026-097 · Authentication & identity
Atlassian adds resource-restricted OAuth 2.0 tokens for new 3LO apps
New Atlassian OAuth 2.0 (3LO) apps can use a resource-level grant so each access token is confined to the site or sites selected during consent.
Previous state
Atlassian OAuth 2.0 (3LO) apps used an account-level grant: a user consented at the Atlassian-account level, and one grant could cover multiple sites where the app was installed, subject to the requested scopes.
Current state
Developers creating a new OAuth 2.0 (3LO) app can choose a resource-level grant. Consent is limited to the Atlassian site or sites the user selects, and tokens derived from that grant cannot be used with sites absent from the accessible-resources response.
Affected users
Who needs to care
Developers creating new external integrations in the Atlassian developer console, plus consent and API-routing logic that must distinguish account-level grants from resource-level grants and use the selected sites’ cloud IDs.
Required response
What to do
When creating a new 3LO integration, choose the resource-level grant if site-bounded access is required; exercise the consent flow, call GET /oauth/token/accessible-resources with the issued token, and route Jira or Confluence API requests with a returned cloud ID.
Evidence boundary
What the source does not prove
Atlassian announced resource-restricted tokens for developers creating new 3LO apps. The sources do not state that existing apps are converted automatically or impose a migration deadline, and user permissions still constrain API access independently of token scopes.
Lifecycle history
Dated event sequence
- Resource-level grant became available
Atlassian made resource-restricted tokens available when creating new OAuth 2.0 (3LO) apps, limiting each grant to the sites selected during consent.
Evidence ledger
First-party sources
- 01Atlassian — Resource-Restricted Tokens for OAuth 2.0 (3LO) Apps
Official Atlassian OAuth changelog · 2026-06-18
Open official source ↗ - 02Atlassian — OAuth 2.0 (3LO) apps
Official Atlassian developer documentation · 2026-09-03
Open official source ↗