Authentication for Apps

YouTrack runs the scripts contained in an app package within its own JavaScript runtime. This means you don't need to provide any extra authentication details in your scripts.

Uploading a new app package or installing a new app from JetBrains Marketplace requires the Update App Content permission in at least one project, or the system Low-level Admin Write permission.

Updating an existing app, either by uploading a ZIP archive or installing a Marketplace update, requires Update App Content in every non-archived project where the app is attached. If the app is not attached to any non-archived projects, this permission is required in at least one project. Users with Low-level Admin Write can update apps regardless of project permissions.

Updating an app that contains global modules requires Low-level Admin Write. Upgrading a Marketplace app to a higher major version also requires this permission. If a user without this permission installs a new app that contains global modules, the app is deactivated automatically. A user with Low-level Admin Write must activate it. For details, see Scopes for HTTP Handlers.

For command-line uploads, use a permanent token for an account with the required upload permissions. To attach project-level app modules to projects, you need Update Project permission for the corresponding projects. For details, see Upload the App to YouTrack and Permissions.

Widget scripts that use the Host API are authenticated by YouTrack as the current user. For example, requests sent with host.fetchYouTrack() use the user's YouTrack session and don't require an authorization header in the widget code.

If you send requests to the YouTrack REST API or the Hub REST API outside the Host API, follow the authentication guidelines for these APIs. For details, see YouTrack REST API, Hub REST API, and Users, Groups, and Access Management.