Atlassian Compass Authentication

generated: '2026-09-06'
method: searched
source: 'openapi/atlassian-compass-compass-rest-api-openapi.json plus the provider auth docs: https://developer.atlassian.com/cloud/compass/rest/
  (Authentication + Authorization sections of the published contract narrative), https://support.atlassian.com/atlassian-account/docs/manage-api-tokens-for-your-atlassian-account/,
  https://auth.atlassian.com/.well-known/openid-configuration'
summary:
  types:
  - http
  - oauth2
  oauth2_flows:
  - authorizationCode
schemes:
- name: basicAuth
  type: http
  scheme: basic
  sources:
  - openapi/atlassian-compass-compass-rest-api-openapi.json
  description: HTTP Basic with an Atlassian account email as the username and an API token as the password
  credential_issuer: https://id.atlassian.com/manage/api-tokens
  authorization_model: 'Atlassian states: "If you are making calls directly against the REST API, authorization
    is based on the user used in the authentication process." There is no service account and no scope
    negotiation on this path - the token carries the human''s full access.'
  header: 'Authorization: Basic base64(email:api_token)'
  rotation: API tokens can be revoked individually from the Atlassian account token manager
  mfa_note: Atlassian states API tokens allow authentication even when the organization has two-factor
    authentication or SAML enabled
- name: oauth2
  type: oauth2
  flows:
  - flow: authorizationCode
    authorizationUrl: https://auth.atlassian.com/authorize
    tokenUrl: https://auth.atlassian.com/oauth/token
    scopes: 4
  description: OAuth 2.0 (3LO) for Atlassian Cloud
  sources:
  - openapi/atlassian-compass-events-api-openapi.yml
  - openapi/atlassian-compass-metrics-api-openapi.yml
  discovery: https://auth.atlassian.com/.well-known/openid-configuration
  authorization_server_metadata: https://auth.atlassian.com/.well-known/oauth-authorization-server
  pkce:
  - S256
  dynamic_client_registration: https://auth.atlassian.com/oidc/register
  revocation_endpoint: https://auth.atlassian.com/oauth/revoke
  device_authorization_endpoint: https://auth.atlassian.com/oauth/device/code
  scopes_detail: scopes/atlassian-compass-scopes.yml
docs:
- https://developer.atlassian.com/cloud/compass/rest/
- https://developer.atlassian.com/cloud/compass/integrations/get-started-integrating-with-Compass/
additional_surfaces:
- surface: Atlassian Rovo MCP Server
  endpoint: https://mcp.atlassian.com/v2/mcp
  method: OAuth 2.1 with dynamic client registration
  protected_resource_metadata: https://mcp.atlassian.com/.well-known/oauth-protected-resource/v2/mcp
  registration_endpoint: https://mcp.atlassian.com/v1/register
  note: Compass access over MCP is OAuth-only; Atlassian states API-token authentication is not supported
    for the Compass permission groups.
- surface: Atlassian platform GraphQL API
  endpoint: https://api.atlassian.com/graphql
  method: OAuth 2.0 3LO, or HTTP Basic with an API token for direct calls
  note: Atlassian's own Compass event-source walkthrough uses an API token against the GraphQL gateway,
    so both credential types reach the catalog.