Jira

1. In your zone’s Keycard Console, go to Resources -> Explore Resources.

2. Search for Jira and click into the catalog entry.

3. The install dialog shows a Redirect URI. Copy it - you’ll paste it into Jira in Step 2. Leave this Keycard tab open.

1. Go to the Atlassian Developer Console
2. Click Create → OAuth 2.0 integration
3. Enter a name for your integration
4. Click Create

1. Go to Permissions in your app settings
2. Find Jira and click Add
3. Configure the scopes:
   • read:jira-work - Read Jira project and issue data
   • read:jira-user - Read user information
   • write:jira-work - Create and edit issues

1. Go to Authorization in your app settings
2. Click Add next to OAuth 2.0 (3LO)
3. Enter the redirect URI provided by Keycard as the Callback URL

1. Go to Settings in your app
2. Note the Client ID and Secret

1. Switch back to the Keycard install dialog you left open in Step 1.

2. Paste the Client ID and Client Secret from Step 2.

3. Click Add Jira. The resource is provisioned and your app can start exchanging tokens for it.

After installing Jira, your application exchanges a Keycard-issued access token for a token scoped to this resource. Pass the user’s access token as the subject_token.

from keycardai.oauth import Client, BasicAuth, TokenType
import requests

# Exchange the user's Keycard token for a Jira token.
with Client(
    "https://<zone-id>.keycard.cloud",
    auth=BasicAuth("<your-client-id>", "<your-client-secret>"),
) as client:
    response = client.exchange_token(
        subject_token=user_access_token,
        subject_token_type=TokenType.ACCESS_TOKEN,
        resource="https://api.atlassian.com/ex/jira",
    )

# Call Jira directly with the exchanged token.
r = requests.get(
    "https://api.atlassian.com/ex/jira/<endpoint>",
    headers={"Authorization": f"Bearer {response.access_token}"},
)

import { TokenExchangeClient } from "@keycardai/oauth/tokenExchange";

const client = new TokenExchangeClient("https://<zone-id>.keycard.cloud", {
  clientId: "<your-client-id>",
  clientSecret: "<your-client-secret>",
});

const response = await client.exchangeToken({
  subjectToken: userAccessToken,
  resource: "https://api.atlassian.com/ex/jira",
});

// Call Jira directly with the exchanged token.
const res = await fetch("https://api.atlassian.com/ex/jira/<endpoint>", {
  headers: { Authorization: `Bearer ${response.accessToken}` },
});

See the OAuth SDK → Token Exchange reference for the full client API.

Now do this

• Call Jira from your code - see the Use Jira from your code section above for Python and TypeScript samples.

Recommended

• Decide who can use it - write access policies scoped to the Jira resource so only the right users and apps reach the API.
• Watch the calls - every token exchange and downstream call lands in your audit log with user identity, resource, and policy decision.

Optional

• Add MCP access too - install the Atlassian MCP server for AI agents that need Jira’s tools, not just the REST API.