Creating Personal Access Tokens (GitHub & GitLab)
The Add Integration wizard lets you authenticate with OAuth, a personal access token (PAT), or - for GitLab - a webhook-only connection. Self-hosted GitHub Enterprise Server and self-managed GitLab always require a personal access token, since OAuth is only available for GitHub.com and GitLab.com. This page covers the scopes needed for a PAT on each provider.
GitHub Personal Access Token
Fine-Grained Token (Recommended)
- On GitHub, go to Settings → Developer settings → Personal access tokens → Fine-grained tokens
- Click Generate new token
- Select the repositories the token should access
- Under Repository permissions, grant:
| Permission | Level |
|---|---|
| Contents | Read (Read and write if developers will create branches from Jira) |
| Metadata | Read |
| Pull requests | Read (Read and write if developers will create pull requests from Jira) |
- Click Generate token and copy it - GitHub only shows it once
Classic Token (Alternative)
If using a classic personal access token, grant the repo scope for private repositories, or public_repo for public repositories only.
GitLab Personal Access Token
- On GitLab, go to Preferences → Access Tokens (or the project/group's Settings → Access Tokens for a project- or group-scoped token)
- Enter a name and expiration date
- Select the scope:
| Scope | What It Allows |
|---|---|
| read_repository | View commits, branches, merge requests, pipelines, and deployments |
| api | Also required if developers will create branches or merge requests from Jira |
- Click Create personal access token and copy it - GitLab only shows it once
Warning: GitLab personal access tokens have an expiration date. Rotate the token from Manage Integrations → (row Actions) → Settings before it expires to avoid an interruption in syncing.
Rotating a Token
If a token expires or is revoked, the repository's status will show an error. Generate a new token with the same scopes and update it from Manage Integrations → (row Actions) → Settings - the repository connection and its historical data are preserved.