How to identify the site (cloudId) from an OAuth 2.0 (3LO) access token?

[Tim Beer]

Hi everyone,

I'm using OAuth 2.0 (3LO) to authenticate users in my app. After completing the auth flow, I receive an access token - and I can then call the /oauth/token/accessible-resources endpoint to get the cloudId of the site the user has access to.

My question is:
Is there any way to extract the cloudId (or any site-identifying info) directly from the access token itself? Or is calling /oauth/token/accessible-resources always required to determine which site(s) the token is valid for?

Thanks in advance!

[Mohanraj Thangamuthu]

Hello, Good day. We don't have a direct option to identify the cloud ID from the access token. You need to use /oauth/token/accessible-resources .Thanks

[Tim Beer]

Thanks for the clarification!

I have a follow-up question:
Let’s say a user (e.g. an admin) has access to multiple Jira/Confluence sites (multiple cloud instances under their Atlassian account). After they authorize my app via the 3LO flow, I call /oauth/token/accessible-resources and get a list of accessible resources.

How can I determine which one the user actually authorized during the OAuth flow? For example, if they have access to 3 sites - is there any way to know which site was selected during consent, or do I have to just guess/prompt the user based on the list I get from /accessible-resources?

I’m trying to avoid confusing the user if they have access to multiple sites.

Thanks again!

[karan]

I am facing the same issue, where the whole process happens in the backend itself. For example, we store the refresh token, use it to get an access token, and then use that access token to call the /accessible-resources a API, which returns multiple results.

How can I determine which cloud-id(or ID from the response) should be selected and injected into the API URL and placeholder?