When to use OAuth 2.0 and when Personal Access Token (PAT)?

[sandeep4774]

I went through many documentation to find out an answer for above question. However I am not clear about it. I read that we can use OAuth 2.0 to integrate office 365 mail or Gmail to use with Jira to create issues via an email. What are the other use cases?

Which one is more secure OAuth 2.0 or PAT?

Which one is easy to track to find access problems or security issues?

We are running Jira Data Center 8.16.

[Travis Owens · Accepted solution]

If it's a JIRA Cloud based site, you can log into your account and use the token generator and then you shouldn't even need to use OAuth at all in your application.  Ideally it's best to store a token NOT in your code as if the token expires or gets replaced, you don't want to have to update and deploy a code change.  You could store the token in your database, retrieve it, and cache that token.

You can find the token generator at: https://id.atlassian.com/manage-profile/security/api-tokens

[Travis Owens · Accepted solution]

I believe the approach is you use OAuth on your initial login to get a token, and then send that token to the API calls.  Authorization tends to be a slow process and tokens are super fast.  It's almost always a bad architecture to fire off a new auth against every API call.