Timesheets (Cloud)
Timesheets (Cloud)
Breadcrumbs

Using OAuth 2.0 Authentication

Extending the functionality of Tempo to integrate with external systems or users requires the Tempo Administrator, Jira Administrator, Tempo Team Administrator, and Tempo Account Administrator permissions.

Integrators can use OAuth 2.0 to provide secure authentication for access to Tempo data.

The Implicit authorization grant type has been deprecated and can no longer be selected.

Generate Credentials for Access to Tempo Data

  1. Select Settings in the Tempo sidebar.

  2. Under Data Access, select OAuth 2.0 Applications.

  3. Add a New Application.

    oauth-new-app.png

  4. Enter Name, Redirect URLs, and Client Type.

  5. Click Add.

Your named credentials are generated and added to the page. You can copy your credentials immediately or view them later.

oauth-creds.png

View Generated Credentials

  1. In the list of OAuth 2.0 Applications, find your named credentials.

  2. Open the Actions menu, and then select Credentials.

    oauth-actions-menu.png

  3. Click the Copy icon to the right of the Client ID or Client secret to copy it to the clipboard.

    oauth-creds.png

You can obtain an access token for your application, and then make requests to the Tempo REST API.

Forge-migrated Instances: If your Jira instance has been migrated to the Forge platform and you encounter an "Invalid client id: undefined" error when using the standard redirect URL, you may need to link directly to the Forge authorization page.

Direct Forge Authorization URL:
https://<your-site-name>.atlassian.net/apps/full-page/<installationId>/oauth-authorize/?client_id=<CLIENT_ID>&redirect_uri=<REDIRECT_URI>

  • <your-site-name>: Your Jira Cloud subdomain.

  • <installationId>: The unique ID for the Tempo installation on your instance.

Identifying the Authorizing User

When an application obtains an access token via Tempo OAuth 2.0, the token grants access to Tempo data based on the permissions of the user who authorized it.

Please note the following regarding user identification:

  • No "Whoami" Endpoint: The Tempo REST API does not currently provide a whoami or me endpoint to identify the authorizing user from the bearer token alone.

  • No User Details in Token: Tempo does not return the Atlassian accountId or other profile details of the authorizing user to the application owner during the OAuth flow.

  • Jira API Requirement: To identify the user, your application must separately authenticate with the Jira Cloud REST API and use the Jira Cloud platform REST API (GET /rest/api/3/myself) using a Jira-specific token. The Tempo bearer token cannot be used to call Jira APIs.

Update Generated Credentials

  1. In the list of OAuth 2.0 Applications, find your named credentials.

  2. Open the Actions menu, and then select Edit.

  3. Update the application, and then click Edit Application.

The named credentials are updated.

Revoke Credentials

  1. Select the credentials you want to revoke.

  2. Open the Actions menu, and then select Delete.

Refer to the Tempo REST API documentation for information about how to retrieve, restore, and revoke an access token. For detailed information about OAuth 2.0, consult their specification at https://oauth.net/2/ .