There is currently no supported way to add or remove users from a Jira group from an automated, unattended context. This blocks any app that needs to provision or deprovision product access programmatically.

Every available authentication mechanism fails or is unsuitable:

• Forge asApp() with write:group:jira, read:group:jira, manage:jira-configuration
• Adding the Forge app account to a privileged group
• Forge asUser() from a scheduled trigger or automation:actionProvider
• Service account with OAuth 2.0 client_credentials, scopes write:group:jira delete:group:jira read:group:jira present in the token
• Service account with manage:org against /admin/v1/orgs/{orgId}/directory/groups/{groupId}/memberships
• Organization API key
• Site admin API token with basic auth

In a Jira Software project, an issue-level access grant is meaningless without product access. Any app that automates access control must therefore be able to manage licensing group membership. Without this, app vendors are forced to either require customers to hand over an organization API key, or drop the automation entirely and require manual admin intervention for every access change.