Yes. Jira Cloud has a REST API, currently version 3, for building apps, scripting interactions or developing integrations. How you authenticate depends on what you build: Forge, Connect, OAuth 2.0 (3LO) for other integrations, or basic auth with an API token for personal scripts.
The Jira REST API lets you work with Jira programmatically: create and update work from a form, pull status into a client report, or script a clean-up job you'd otherwise do by hand. This page covers Jira Cloud only.
Which authentication route fits what you're building
| You're building | Use | Example address |
|---|---|---|
| A Forge app | REST API scopes | /rest/api/3/issue/DEMO-1 |
| A Connect app | JWT-based auth built into the Connect libraries | Your site address plus /rest/api/3/issue/DEMO-1 |
| Any other integration | OAuth 2.0 authorization code grants (3LO) | Atlassian's API gateway, then /ex/jira/ |
| A personal script, bot or one-off call | Basic auth with your Atlassian account email and an API token | Your site address plus /rest/api/3/ |
For most small businesses, the choice is between the last two rows. A script you run yourself can use basic auth with an API token. Anything other people will use, or anything that runs for a client, should use OAuth 2.0 (3LO). Atlassian says basic authentication isn't as secure as the other methods and recommends 3LO.
In plain terms, 3LO means each person signs in with their own Atlassian account and agrees to let your integration act for them. Your calls then go through Atlassian's API gateway with the site's cloud ID in the path, rather than straight to the site address. It takes a little longer to set up than an API token, but nobody has to share a password or a token, and access can be withdrawn per person.
Version 2 or version 3
Version 3 is the latest. Versions 2 and 3 offer the same operations, so you won't lose features by picking either. The difference is formatting: version 3 supports Atlassian Document Format in comments, worklogs, the issue description and environment fields, and in multi-line custom fields. If you want rich text, headings or tables in what your integration writes, use v3.
Three rate limits running together
There isn't one rate limit to remember. The Atlassian developer documentation describes three independent systems enforced at the same time:
- A points-based hourly quota, where each call spends points based on the work it does, such as the amount of data returned.
- Per-second burst limits on each endpoint.
- Per-issue write limits, so hammering one work item with updates gets throttled on its own.
The same points model applies to the REST and GraphQL APIs. Points-based limits are enforced from March 2, 2026 for Forge, Connect and OAuth 2.0 apps. Traffic using an API token isn't affected by the points system and stays under the existing burst limits.
Go over any of the three and you'll get HTTP 429 Too Many Requests. Respect the Retry-After header and back off before trying again.
Why your script and your app behave differently
This is where people get confused. A personal script on an API token and an OAuth app doing the same job can hit limits at different times, because the points quota only applies to app traffic. So if your quick script runs fine but the polished integration you built for the team starts returning 429s, the points quota is the likely reason. Ask for less data per call and spread writes across time rather than per issue in a burst.
If you're deciding whether to poll the API or have changes pushed to you, this explainer on APIs versus webhooks helps. And if you're publishing your own internal docs for an integration, here's my list of API documentation tools.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
APIs from neighbouring tools
Linear's public API is built with GraphQL, and its webhooks send HTTP(S) push notifications when data is created or updated. Asana returns a 429 with a Retry-After header when you go over its limits, and its search API is limited to 60 requests per minute. For a wider comparison of the trackers themselves, see my list of Jira alternatives.
My verdict on getting started
For a quick job, make an API token and call v3 with basic auth from a script, keeping it to your own account. For anything the team or a client will rely on, build it with OAuth 2.0 (3LO) from day one, ask for only the fields you need, and handle 429 with Retry-After. That keeps you clear of all three limits.
Want your tool on this list? Featured spots and reviews here are paid partnerships. Here's how to partner with me.
Frequently asked questions
Does Jira have a REST API?
Yes. Jira Cloud's REST API v3 is the latest version.
How do I authenticate?
Forge, Connect or OAuth 2.0 (3LO) for apps and integrations; basic auth with an API token for personal scripts.
Is basic auth recommended?
Atlassian says it's less secure and points to OAuth 2.0 (3LO).
Are there rate limits?
Yes: a points quota, burst limits and per-issue write limits. Going over returns 429.
Is v2 different from v3?
They offer the same operations, but v3 supports Atlassian Document Format in several fields.
