Skip to main content

​
Overview

OneCLI connects AI agents to Jira Cloud. Agents can search issues with JQL, read and create them, comment, and move them through a workflow. The gateway injects the token into requests to api.atlassian.com, so your agent never sees it. Connecting takes one click. You don’t create an Atlassian app or copy any keys.

​
What you will set up

  • A Jira Cloud connection through Atlassian OAuth, with no app or keys to create
  • Automatic token injection on requests to api.atlassian.com
  • Per-agent, per-tool access, such as approval before deleting issues

​
Connect Jira

1

Click Connect

In the OneCLI dashboard, open Connections > Jira and click Connect Jira.
OneCLI connect window for Jira, showing the Connect to Jira button and an auto-connect countdown.

The Jira connect window in OneCLI.

2

Accept in Atlassian

Sign in to Atlassian, pick your Jira site, and click Accept. You’re done. OneCLI keeps the connection active from then on.
You don’t need to be a Jira admin. Atlassian may show a notice that the app hasn’t been reviewed by Atlassian yet. It’s safe to continue.

​
What agents can do

​
Controlling access

Grant the connection to each agent that needs it, and choose per tool what runs freely, what needs approval, and what’s blocked. For example, let an agent search and read freely, but put Transition issue and Delete issue behind approval. Organization rules add guardrails on top. A blocked request never reaches Jira. To disconnect, remove the connection in Connections > Jira, then revoke OneCLI in Atlassian under Account settings > Connected apps.

​
Self-hosted: use your own Atlassian app

Skip this section on OneCLI Cloud. It’s only for self-hosted OneCLI without ATLASSIAN_CLIENT_ID and ATLASSIAN_CLIENT_SECRET set, or if you want your own company name on Atlassian’s consent screen. One Atlassian app serves both Jira and Confluence: you save it once, register one callback URL, and people connect either app with it.

1. Create the Atlassian app

Go to developer.atlassian.com/console/myapps. Select Create > OAuth 2.0 integration, name it OneCLI, accept the terms, and select Create. For Access type, choose Resource-level, so the token only reaches the site you pick.
Open Permissions. For each API, click Add, then Configure:Use these exact classic scope names. The granular ones (read:issue:jira and so on) don’t match what OneCLI requests.
Also add the Confluence scopes from the Confluence page, even if you only use Jira. Atlassian keeps one consent per person for each app, so OneCLI asks for the Jira and Confluence scopes together. If any of them is missing from the app, Atlassian shows an error instead of the consent screen.
Atlassian developer console Permissions page showing Scopes Used 4, with the Jira API row at 3 scopes and the User identity API row at 1 scope.

Permissions after adding all four scopes.

In OneCLI, open Connections > Jira > Custom credentials and copy the Redirect URI. It ends in /v1/apps/oauth/atlassian/callback, the same URI for Jira and Confluence. In the developer console, open Authorization, click Configure next to OAuth 2.0 (3LO), paste it into Callback URLs, and save.
OneCLI Custom credentials card for Jira with the setup guide link, the Redirect URI and its copy button, and the client ID and secret fields.

Copy the Redirect URI from Custom credentials in OneCLI.

In the developer console, open Settings and copy the Client ID and Secret under Authentication details.
Atlassian developer console Settings page showing the Authentication details card with a Client ID field and a masked Secret field, each with a copy button.

Client ID and Secret on the Settings page.

Paste both into Connections > Jira > Custom credentials, select Save & Connect, and accept in Atlassian. The app now serves Confluence too: connect it from Connections > Confluence without entering credentials again.
An Atlassian app has only one callback URL. If your app still has an older per-app URI (ending in /v1/apps/jira/callback), replace it with the one above.

​
FAQ

No. Any Jira user can connect. Atlassian may show a notice that the app hasn’t been reviewed yet, and it’s safe to continue.
No. The token stays in OneCLI, and the gateway adds it at the proxy. See How it works.
Yes. Block Delete issue or put it behind approval when you grant the connection.
On self-hosted, one Atlassian app serves both Jira and Confluence.