/
[Forge Migration][2025-11-14] Classic Atlassian JWT Access tokens for Release Management APIs will be deprecated as of Dec 12, 2025

[Forge Migration][2025-11-14] Classic Atlassian JWT Access tokens for Release Management APIs will be deprecated as of Dec 12, 2025

Confirmation

We removed ability to use JWT tokens to access our APIs as of Dec 15, 2025.

Summary

  • Only applicable if you are using our REST APIs, otherwise feel free to skip.

  • Classic Atlassian JWT Access Tokens will be deprecated on Dec 12, 2025. Personal API Access Tokens should be used instead.

  • Check on your Automation Rules, CI/CD callbacks, BI extracts, Migration or any other scripts that might be in use.

  • Be aware of Personal API Tokens lifetime, plan for rotation in advance.

Introduction

Since the last upgrade, our UI is now Forge-based with egress to our API endpoints. We’ve also retained several Connect modules for backward compatibility, which we plan to phase out shortly.

As part of this transition, we are deprecating Classic JWT Access Tokens for our APIs as of Dec 12, 2025. Instead, please use Personal API Access Tokens, which became generally available to all users with our latest release:
Personal API Access Tokens

The following section(s) describe the required changes in detail.

If you are not using our APIs from Jira Automation or any third-party systems, you can safely skip this update—no changes are required on your side.

Changes

We are deprecating Classic JWT Access Tokens for our APIs as of Dec 12, 2025. Instead, please use Personal API Access Tokens, which became generally available to all users with our latest release:
Personal API Access Tokens

Where I need to change?

From the use cases we see and use cases we discussed with you clients over the last years there’re couple of places where the change might required. Please check:

  • Jira Automation rules if it issues Web Request to our API endpoints

  • Release Automation - our Automation Engine, available via Board Settings - for Webhook Actions that might trigger our API endpoints

  • Your CI/CD tools that might call our API endpoints as callbacks from pipeline execution.

  • Your PowerBI, EasyBI or any other BI tools you might use to retrieve data from Release Management App

  • Your Postman, ScriptRunner scripts, you name it - where you might be calling our API endpoints to trigger some action or retrieve data

  • Your Migration scripts if you are running Data Center to Cloud or Cloud to Cloud migrations at the moment.

What I need to change?

  1. Remove (now) unnecessary calls to extract Classic JWT token

    1. Check also lookups in Jira Automation or any other temporary storages you might be using for storing Classic JWT token for further API calls. You can now remove it as well.

  2. Change Header for APIs calls as outlined below:

Before

After

Before

After

Header:

Authorization: JWT <extracted_token>

Header:

X-RM-Token: <personal_token_body>

At the same time, the Authorization header should be removed.

All our Sample Automation Use Cases where updated to replicate the change so you also might look at it for a reference.

Any important considerations about the change?

Yes.

Previously, you were extracting a Classic JWT that was newly issued each time and valid for 15 minutes before being revoked.

With Personal API Tokens, you must define a lifespan, which can be up to one year. Please make sure to set yourself a reminder to rotate these tokens before they expire; otherwise, your rules or scripts may stop working, potentially causing operational interruptions.