Integromat Jira connection error (API Key)

[Thomas Johannsen]

I just set up a new Jira environment to run client demos (https://sx-demos.atlassian.net/). I created an API key and copied all the relevant details into Integromat, but I get this error.

"An unexpected error has occured. Please contact your JIRA Administrator. - Basic authentication with passwords is deprecated. For more information, see: https://confluence.atlassian.com/cloud/deprecation-of-basic-authentication-with-passwords-for-jira-and-confluence-apis-972355348.html"

I am site Administrator.

I have a currently working connection set up to the normal company Jira (https://scientrix.atlassian.net/), I deleted this connection and created it again with no issues.

I do exactly the same for the new environment but it doesn't work. The only difference that I can see is that the new api key is only 21 characters long and the old one is 25.

[Andy Heinzer · Accepted solution]

Hi Thomas,

I understand that you're using Jira Cloud and are trying to integrate this to Integromat using an API token.  I am afraid that I don't have any experience using Integromat, but the error message you are seeing would tend to indicate that you might be trying to use that API token in a manner like you would use a password.

In which case I would actually refer you to this other deprecation notice over in Deprecation notice - Basic authentication with passwords and cookie-based authentication.  So again, I don't know how Integromat handles this, but it is very possible that you might have been able in the past to use that API token in the exact same way as a password.  But since we deprecated the use of passwords for basic auth, the only way that API token will be able to work is for you to encode it along with your username into a base64 string and then pass it as a header in your REST API call.

More detailed steps on how we expect that call to happen are explained in Basic auth for REST APIs.

• Linux/Unix/MacOS:

  echo -n user@example.com:api_token_string | base64

• Windows 7 and later:

  $Text = ‘user@example.com:api_token_string’
  $Bytes = [System.Text.Encoding]::UTF8.GetBytes($Text)
  $EncodedText = [Convert]::ToBase64String($Bytes)
  $EncodedText

Those steps can then at least give you an encoded string of characters that can then be added to the header of the REST API call.  We've included an example of how this would work in a utility like curl:

curl -D- \ -X GET \ -H "Authorization: Basic ZnJlZDpmcmVk" \ -H "Content-Type: application/json" \ "https://your-domain.atlassian.net/rest/api/2/issue/QA-31"

But it's not clear to me if Integromat can be setup to use this kind of authorization header in the call it is making to Jira Cloud.  If it can, then this should get things working.  If it cannot, then I would recommend reaching out to Integromat in order to see if they can somehow support this kind of header in the calls it makes to Jira Cloud.

I hope this helps.  Let me know the results.

Andy

[Thomas Johannsen]

When I create a connection in Integromat it asks me for the name of the connection, Service URL for my Jira instance, Username and API Token, I don't know what it then does.

But it works fine for https://scientrix.atlassian.net - thomas.johannsen@scientrix.com and the api token, but it doesn't work for https://sx-demos.atlassian.net - thomas.johannsen@scientrix.com and the api token. 

This is the Integromat help centre guide to creating the Jira - Integromat connection:
https://support.integromat.com/hc/en-us/articles/360007190534.

[Andy Heinzer]

Thanks for the help guide link.  That link is rather confusing.  The title states this is for Jira Server, but clearly their own screenshot examples are clearly showing this integration using Jira Cloud.  Their suggestion to create an API Token on https://id.atlassian.com/manage/api-tokens would only apply to Jira Cloud sites, and never to a Jira Server site.  Jira Server does not currently allow users to create their own API Token, like Jira Cloud does.  However Jira Server does still permit REST API calls to utilize username and passwords directly for authentication.  Where Jira Cloud does not.

That said, any domain that ends in atlassian.net is clearly an Atlassian Cloud site.  It looks like you have the same user account here between these sites, which is common.  So creating a single API token for that account on the https://id.atlassian.com/manage/api-tokens site, will then allow you to use those same credentials across any Atlassian Cloud site.

I took a closer look at the account you mentioned here.  It appears that the working account is a site-admin of that Cloud site, but that on the non-working one (scientrix.atlassian.net), the user account you mentioned of (thomas.johannsen@scientrix.com) is not a site-admin there and instead is just a regular user on that site. 

I'm not sure if that is a factor here as I am not clear as to what exact REST call Integromat is trying to make when setting up this integration.  But it might be a factor here if it's trying to make some kind of call that only a site-admin would be able to perform.  But if that was the case, I would expect the error message to be slightly different here.

Andy

[Thomas Johannsen]

I didn't know that the generated credentials work across different sites for the same user.

I tried the original api token for thomas.johannsen@scientrix.com that I generated at scientrix.atlassian.net and it works in Integromat for sx-demos.atlassian.net.

I'm not sure why the one I generated on sx-demos doesn't work though. I created 3 different ones, for 3 different users and none of them work. All give the same error. Maybe the problem is with how the site was set up/create.

I don't think it the admin level you mentioned, as it's the other way around. It works from scientrix.atlassian.net, where I am not site admin, but doesn't work on the sx-demos.atlassian.net site where I am site admin.

[Thomas Krause]

Any changes, insights on this issue meanwhile? @Thomas Johannsen did you solve this issue?

Contacted the Integromat support yday and it's also getting a bit confusing if Server/Cloud is meant in the documentation.

Anyway, would be happy to get some hints how to get Integromat work with Jira Cloud, preferably the Service Management API.

Was trying to use the generic WebRequest module in Integromat and I couldn't create a connection there either.

[lvanackere]

Hey guys,

I am from Integromat. For clarity: our app integration is indeed for Jira Cloud Platform not Jira Server Platform. Also we are doing as @Andy Heinzer says, we are taking your username and API token and wrapping it together into a base64 string and sending it as an Authorization header.

AKA "authorization": "Basic base64(username+:+apiToken)"

@Thomas Krause Could the issue be related to what Andy says, where it works for a user that is site-admin and does not work for a non site-admin. The Atlassian permission configurations can be a bit complex.

Louis

integromat.com