Connecting Jira to Stacktic

For: anyone connecting your Jira site, plus an Atlassian organization admin if you also want offboarding. Takes about 5 minutes for read-only access, or 10–15 minutes if you add offboarding.

What this integration does

Connecting Jira lets Stacktic see everyone with an account on your Jira Cloud site. If you also add an organization admin credential, Stacktic can deactivate or delete someone's Atlassian account when they leave your company.

Jira asks for two separate credentials, because it's really two connections in one:

Value	What it's for	Required?
Site URL, account email, API token	Reads your site's users. Works on any Jira plan.	Always
Org admin API key	Adds offboarding (deactivate or delete the account of someone who's leaving).	Optional

The site credential is a password for apps that belongs to one person. Atlassian calls this an API token. It's created by an Atlassian account, and it has that account's privileges. The optional admin key is a separate, more powerful credential from Atlassian's organization admin console. Stacktic stores both encrypted.

Before you start

You need an Atlassian account on the Jira Cloud site you're connecting. Any account works. You don't need to be an admin to read the site's users.
Know the site's URL (https://your-company.atlassian.net).
If you also want offboarding: you (or someone on your team) need to be an organization admin. The organization also needs Atlassian Guard with a verified domain. Without Guard, you can only use the read-only half of this integration.

Step 1: Create an API token

Go to id.atlassian.com → Security → API tokens.
Create a new token and copy it. You won't be able to see it again.

This is the token described in Atlassian's own Manage API tokens for your Atlassian account guide.

Step 2: Connect in Stacktic

In Stacktic, go to Tools → Jira → Integration and enter:

Site URL: your Jira Cloud site's base URL, for example https://your-company.atlassian.net.
Account email: the Atlassian account the API token belongs to.
API token: the token from Step 1.

If you only want to see who has access, leave Org admin API key and Offboarding action blank for now. Click Connect. Stacktic checks the token against the site. If it works, Stacktic starts reading your users.

Step 3: Add offboarding (optional)

Offboarding uses a separate Atlassian API that a site token can't reach. So it needs its own credential:

Go to admin.atlassian.com → Settings → API keys and create an organization admin API key. This requires Atlassian Guard with a verified domain. Without those, this step isn't available to you.
Back in Stacktic's connection screen, paste the key into Org admin API key.
Choose an Offboarding action:
- Deactivate account (reversible): blocks sign-in and takes away access to all Atlassian products. It can be undone.
- Delete account (14-day grace): does the same, but the account is permanently deleted after a 14-day grace period.
Click Connect (or Save, if you're adding this to an existing connection). Stacktic checks the key. If it's good, Stacktic turns on offboarding.

If you skip this step, the connection still works. It just stays read-only, and Stacktic shows that offboarding needs the admin key.

What you'll see

Once you're connected, Stacktic lists everyone with a real Atlassian account on the site. A few things to know about that list:

Bots and portal contacts are left out. Jira's own user list also includes app principals, which are bots and add-ons. On Jira Service Management sites, it also includes customer principals, which are outside portal contacts. Neither is an employee, so Stacktic leaves both out.
Role always shows as —. Jira has no single site-wide role for each user. Permissions come from project roles and groups. So Stacktic doesn't try to show one.
Email can be blank. By default, Jira Cloud hides a user's email under their own profile privacy setting. Stacktic shows what Jira gives it.
A deactivated account still appears in the list, marked as deactivated instead of active. Atlassian's directory keeps disabled accounts. It doesn't remove them.

Read-only vs. offboarding-enabled

Site credential only: Stacktic shows everyone with a Jira account on your site, next to the rest of your tools. Nothing here can change or delete anything.
Site credential plus org admin API key: Stacktic can also deactivate or delete the account of someone who's leaving, during an offboarding. It uses whichever action you chose in Step 3.

You can start read-only and add the admin key later, without reconnecting the site credential. Just edit the connection and fill in the admin fields.

What offboarding does (and doesn't do)

The action you chose runs through the Atlassian Admin lifecycle API. It acts on the same account that shows up in the user list.

Deactivate blocks sign-in and takes away access to all Atlassian products the account uses (Jira, Confluence, everything on Atlassian Guard). It can be reversed.
Delete does the same, then permanently removes the account after Atlassian's 14-day grace period.

Both only work on a managed account. That's an account covered by Atlassian Guard on a verified domain. If the person's account isn't managed, Stacktic can't act on it. The offboarding task is left for a person to finish. It isn't quietly marked done.

Security notes

The site token is personal. It belongs to whichever Atlassian account created it. If that person leaves, the connection stops working. Stacktic flags this, and someone reconnects with a new token.
The admin key is the stronger credential. It's what makes offboarding possible, so only add it if you actually want offboarding. A connection with just the site token can't change anything in Atlassian.
No expiry is reported. Atlassian's API doesn't share an expiry date for the API token or the admin key. So Stacktic can't warn you ahead of time. If a credential is rejected, the connection shows that it needs reconnecting the next time it's used.
Stored encrypted. Stacktic keeps the credentials encrypted. The token and key are never shown again in full.
You can cut it off anytime. Delete the API token at id.atlassian.com, or the admin key at admin.atlassian.com. That half of the connection stops working right away.

Troubleshooting

Message in Stacktic	Likely cause & fix
"Jira rejected the email / API token."	The email or token is wrong, or the token was revoked. Create a new token and reconnect.
"Jira couldn't resolve site '...'. Check the site URL."	The site URL is mistyped, or the site doesn't exist.
"Atlassian rejected the org admin API key."	The admin key is wrong or was revoked. Create a new one at admin.atlassian.com and reconnect.
"The admin API key administers no Atlassian organization."	The key isn't tied to an organization Atlassian can find. Check that it was created from the right admin account.
"Jira offboarding is not configured — add an Atlassian org admin API key (requires Atlassian Guard)."	Offboarding ran without an admin key on the connection. Add one (Step 3) to turn it on.
Offboarding fails: "...is not a managed account — cannot [deactivate/delete] it via the admin key (requires Atlassian Guard)."	The person's account isn't covered by Atlassian Guard on a verified domain. Remove them by hand in Atlassian.
Offboarding fails: "Atlassian account ... not found on ..."	The account isn't on this site. It was already removed, or it never was there.
"...reached the 1000-user /users/search cap — refusing to return a possibly-truncated roster."	Your site has more users than Jira's search endpoint can page through. This is a large-site limit on Atlassian's side. The sync fails loudly instead of quietly showing a partial list. It's a known gap, not something you can work around on your end.

Frequently asked questions

Do I need to be a Jira admin to connect? No. Reading your site's users only needs a valid Atlassian account and an API token for it. Any member can set up that part. Offboarding is the part that needs an organization admin.

Does this work on any Jira plan? Yes, for reading users. Offboarding also requires Atlassian Guard with a verified domain. Guard is a separate add-on from your Jira plan.

We have more than one Jira site. Does one connection cover all of them? No. Each Jira site needs its own connection, with its own site credential.

Will connecting change or delete anything right away? No. Connecting only reads your site's user list. The deactivate or delete action only runs during an actual offboarding, and only once you've added the org admin API key.

What's the difference between deactivate and delete? Deactivate blocks sign-in and access, but it can be undone. Delete does the same, then permanently removes the account after a 14-day grace period that Atlassian enforces. You pick one for each connection in Step 3.