Jira OAuth client

Who does this (customer vs Solvaro)

Yes — each customer creates this OAuth 2.0 (3LO) app in their own Atlassian developer console. Solvaro company does not register a Jira app for you. Paste Client ID + Secret into Solvaro Settings (org member). Until that save (or a token Alternative), Sign in stays 400 / Coming soon.

• Customer Atlassian admin: Create → OAuth 2.0 (3LO), not Forge (fields below).
• Customer Solvaro admin: paste Client ID + Secret + optional site URL in Settings → Connectors → Jira → Org Jira OAuth app.
• Solvaro company: callback URL already exists on the API. Railway ATLASSIAN_* is not the customer path (that unidentified client_id caused “couldn’t identify the app”).
• Without org paste, connect is 400. That is expected. Marketplace / one app for every site = later (#63 Sharing if we list an Solvaro app).
• You create the Jira email and API token in your Atlassian account. Solvaro does not issue a Jira token.

Fill-in-the-blank

• App type: OAuth 2.0 (3LO) — not Forge.
• Name: Solvaro (what agents see on consent).
• Callback URL: exactly one HTTPS URL, no trailing slash (below).
• Permissions (Jira API): read:jira-work, read:jira-user, write:jira-work, offline_access. Do not add JSM servicedesk scopes until this same app has them in the console.
• Settings: copy Client ID and Secret. Secret is shown once.
• Optional: Distribution → Sharing if teammates who are not the app creator must Sign in. Privacy URL if prompted: https://solvaro.ai/privacy.

Callback URL (exact)

Must match the API host. Not Netlify, not localhost, no trailing slash.

https://api.solvaro.ai/api/v1/oauth/jira/callback

Where to paste Client ID and Secret

• Paste into Solvaro: Settings → Connectors → Jira → Org Jira OAuth app → Client ID, Client secret, optional Jira site URL → Save org OAuth app.
• Do not put the secret in Slack or email.
• This is your company’s 3LO app (bring-your-own). Teammates then use Sign in; they do not need the secret.

After Save

1. Use Sign in with Jira. Approve the consent screen for your 3LO app.
2. Run Test connection. Load a real ticket. If Test is red, stay on Alternative credentials (API token).