How to identify the site (cloudId) from an OAuth 2.0 (3LO) access token?

[Tim Beer]

Hi everyone,

I'm using OAuth 2.0 (3LO) to authenticate users in my app. After completing the auth flow, I receive an access token - and I can then call the /oauth/token/accessible-resources endpoint to get the cloudId of the site the user has access to.

My question is:
Is there any way to extract the cloudId (or any site-identifying info) directly from the access token itself? Or is calling /oauth/token/accessible-resources always required to determine which site(s) the token is valid for?

Thanks in advance!

[Mohanraj Thangamuthu]

Hello, Good day. We don't have a direct option to identify the cloud ID from the access token. You need to use /oauth/token/accessible-resources .Thanks

[Tim Beer]

Thanks for the clarification!

I have a follow-up question:
Let’s say a user (e.g. an admin) has access to multiple Jira/Confluence sites (multiple cloud instances under their Atlassian account). After they authorize my app via the 3LO flow, I call /oauth/token/accessible-resources and get a list of accessible resources.

How can I determine which one the user actually authorized during the OAuth flow? For example, if they have access to 3 sites - is there any way to know which site was selected during consent, or do I have to just guess/prompt the user based on the list I get from /accessible-resources?

I’m trying to avoid confusing the user if they have access to multiple sites.

Thanks again!