Integrations that read or manage teams and team memberships through the Atlassian Teams API currently have to authenticate with personal API tokens. Each user has to create a token, and the integration has to store it.

When you set up an OAuth 2.0 (3LO) app in the developer console, the Atlassian Teams API isn't available as a selectable API. That means Teams scopes can't be requested the way Jira or Confluence scopes can, so there's no OAuth-based way to call the Teams API.

Suggested solution

• Add the Atlassian Teams API as a selectable API in the developer console for OAuth 2.0 (3LO) apps.

• Make Teams scopes self-serve, the same as Jira and Confluence scopes. For example: view:team:teams, view:membership:teams, write:team:teams, write:membership:teams.

• Support these scopes on both the Teams REST API and the GraphQL API.

• Document the authorization flow for organization-level resources like Teams.

Why this is important

• Security: Integrations have to store long-lived personal API tokens instead of using scoped, revocable OAuth access granted through consent.

• User experience: Every user has to create and paste in a token by hand.

• Governance: Admins can't easily see or revoke access granted through personal tokens.

• Reliability: Integrations break when tokens expire or when a user's account is deactivated.

Workaround
Users create personal API tokens and the integration stores them. This works, but it has the security, governance and maintenance problems listed above.