> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tai42.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Atlassian

> Atlassian (Jira, Confluence, Compass) OAuth connector provider on Atlassian's hosted Rovo MCP endpoint.

<Info>`Connector` plugin · listing `tai42/connector-atlassian`</Info>

## Install

```bash theme={null}
tai plugins install tai42/connector-atlassian --env CONNECTORS_ATLASSIAN_CLIENT_ID=... --env CONNECTORS_ATLASSIAN_CLIENT_SECRET=... --secret CONNECTORS_ATLASSIAN_CLIENT_SECRET
```

## Permissions

| Capability | Declared |
| ---------- | -------- |
| Network    | no       |
| Subprocess | no       |
| Filesystem | no       |

## Provides

<h3 id="atlassian">
  atlassian
</h3>

`Connector` — OAuth connector for Atlassian (Jira, Confluence, Compass).

Registers the `atlassian` connector: one Atlassian OAuth 2.0 (3LO) connection per
alias, unlocking three services — Jira, Confluence, and Compass. Every service is a
remote HTTP MCP endpoint hosted by Atlassian, so nothing is launched locally. The
plugin is pure descriptor data; the runtime's connector engine runs the OAuth flow,
seals the tokens, and reaches Atlassian's hosted MCP endpoint with the connection's
own token.

## Install

```bash theme={null}
tai plugins install tai42/connector-atlassian \
  --env CONNECTORS_ATLASSIAN_CLIENT_ID=... \
  --secret CONNECTORS_ATLASSIAN_CLIENT_SECRET
```

Or add it by hand to the manifest under `connectors:` (the descriptor block the
plugin provides):

```yaml manifest.yml theme={null}
connectors:
  - id: atlassian
    kind: oauth
    origin: system
    category: dev-tools
    display_name: Atlassian
    description: Connect Jira, Confluence, and Compass.
    icon_url: https://raw.githubusercontent.com/tai42ai/tai42/main/plugins/connector-atlassian/icon.png
    oauth:
      authorize: https://auth.atlassian.com/authorize
      token: https://auth.atlassian.com/oauth/token
      revoke: null
    client_id_env: CONNECTORS_ATLASSIAN_CLIENT_ID
    client_secret_env: CONNECTORS_ATLASSIAN_CLIENT_SECRET
    sub_services:
      jira:
        id: jira
        display_name: Jira
        scopes: [offline_access, read:issue:jira, write:issue:jira]
        mcp_server: {type: http, url: https://mcp.atlassian.com/v1/mcp/authv2}
    extra_authorize_params: {audience: api.atlassian.com, prompt: consent}
```

The manifest block above is trimmed to one sub-service and a short scope set for
brevity; the plugin's `tai-plugin.yml` carries the full set.

## Create the Atlassian app

Create an **OAuth 2.0 (3LO)** app in the Atlassian developer console, enable the
products you intend to offer (Jira, Confluence, Compass), and grant the app the
granular scopes listed below.

Add this exact callback URL, where `{origin}` is your deployment's public origin (or
`CONNECTORS_OAUTH_BRIDGE_URL` when you run a shared bridge):

```
{origin}/oauth-bridge.html
```

Then set the client credentials on the API process:

```bash theme={null}
CONNECTORS_ATLASSIAN_CLIENT_ID=...
CONNECTORS_ATLASSIAN_CLIENT_SECRET=...
```

The engine-wide `CONNECTORS_*` settings — the key-encryption key
(`CONNECTORS_KEK`), the state HMAC key (`CONNECTORS_STATE_HMAC_KEY`), and the
redirect-URI allowlist (or `CONNECTORS_OAUTH_BRIDGE_URL` when you run a shared
bridge) — are shared by every connector and are described in
[Connectors](/concepts/connectors). The origin you registered with Atlassian must
appear in the redirect-URI allowlist, and it must be https for anything but a local
host.

## Services and scopes

Atlassian refuses an app that mixes classic and granular scopes, so every scope below
is granular.

| Service      | Scopes                                                                                                                                                                                                                                                                                                                                                            |
| ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `jira`       | `offline_access`, `read:issue:jira`, `read:issue-meta:jira`, `read:project:jira`, `read:comment:jira`, `read:attachment:jira`, `read:issue-worklog:jira`, `read:jql:jira`, `read:board-scope:jira-software`, `read:sprint:jira-software`, `write:issue:jira`, `write:comment:jira`, `write:issue-worklog:jira`, `delete:issue:jira`, `write:sprint:jira-software` |
| `confluence` | `offline_access`, `read:page:confluence`, `read:hierarchical-content:confluence`, `read:comment:confluence`, `read:space:confluence`, `write:page:confluence`, `read:content-details:confluence`                                                                                                                                                                  |
| `compass`    | `offline_access`, `read:component:compass`, `write:component:compass`                                                                                                                                                                                                                                                                                             |

All three services resolve to Atlassian's hosted MCP endpoint at
`https://mcp.atlassian.com/v1/mcp/authv2`. The authorize request adds
`audience=api.atlassian.com` and `prompt=consent`. `offline_access` is what makes the
refresh token available, so a connection survives the access token's expiry.

<Warning>
  Atlassian publishes no 3LO revocation endpoint, so disconnecting removes the stored
  token from this deployment but cannot revoke it at Atlassian. Revoke the app's access
  from the Atlassian account's connected-apps screen when that matters.
</Warning>

## Connect an account

Each service resolves to Atlassian's hosted MCP endpoint, authorised with the
connection's own token.

## See also

* [Connectors](/concepts/connectors) — the model, the token lifecycle, and the shared engine settings.
* [Connect an OAuth provider](/guides/connect-an-oauth-provider) — the end-to-end walkthrough.