Security

• Client credentials grant — FluidRAG uses OAuth 2.0 client credentials (not user tokens). The integration authenticates as itself with the permissions you configure in the Atlassian developer console.
• Token lock — An async lock prevents race conditions during token refresh in concurrent request scenarios.
• Minimal scopes — Only read:jira-work and read:jira-user scopes are required. FluidRAG cannot create, update, or delete Jira issues.
• No inbound endpoints — FluidRAG only makes outbound API calls to Atlassian. No webhooks or inbound endpoints are required.
• Credentials in etcd — Client ID and secret are stored in etcd (encrypted at rest) and never exposed to the client.