• Products
  • Documentation
  • Resources

Create a tunneled application link

A tunneled application link allows you to select an existing application tunnel that will be used to forward the traffic to the target instance, as opposed to a direct link where you use the URL of the target instance. You can create a tunneled application link only from your cloud product.

Before you begin

Before you can create a tunneled app link, you need to complete these steps:

  1. Install application tunnels

  2. Configure required connections and ports

  3. Create an app tunnel to your self-managed instance

The tunneled links must be created in your Cloud products. The reciprocal links will be created automatically and won’t use the tunnels, because they’re outgoing from your network.

To create a tunneled application link:

  1. Open your cloud product's administration and navigate to application links. This is different from admin.atlassian.com, each product has its own administration.

    • Jira Cloud: Go to Administration > Products > Application links.

    • Confluence Cloud: Go to Administration > Application links.

  2. Select Create link.

  3. On the Create link screen, select Tunneled application link, and then choose the application tunnel that is connected to your self-managed instance. Next, select Continue.

  4. On the Confirm URLs screen, check the URLs and confirm them. Application URL should show the URL of the tunnel, and Display URL the base URL of your self-managed instance.

  5. On the Review link screen, you’ll see the details of the products you’re connecting.

Review links screen that shows the details of the self-managed and cloud instances.

Next, you’ll configure the reciprocal link. The steps depend on whether you’re an admin on the self-managed instance.

You’re an admin on the self-managed instance

  1. On the Review link screen, select the I am an administrator on both instances check box.

  2. Select Continue. You’ll be redirected to the self-managed instance, where you can confirm the links.

  3. After you confirm, you’ll be redirected back to the Cloud site.

  4. The application links will be created on both instances with the status Connected.

You’re not an admin on the self-managed instance

  1. On the Review link screen, clear the I am an administrator on both instances check box.

  2. Select Continue. You’ll get a pop-up with a URL.

  3. Copy the URL and give it to the admin of the self-managed instance.

  4. Once the admin opens the URL, they’ll be moved to the Application links page on the self-managed instance. They need to confirm the links.

  5. The reciprocal link will be created, but the application links on both instances will most likely display the Config error.

  6. To fix this, edit the application link in your Cloud product. Set the local authentication to OAuth for both incoming and outgoing communication.

Details of an application link, showing Local authentication set to OAuth.

You can verify that the application link was correctly created by viewing its details, both on the cloud and self-managed side. Here you can see some examples:


Only this link is using the tunnel, because it’s incoming to your network. The target URL is the URL of your tunnel.

Details of a tunneled application link on the cloud side.


This a direct reciprocal link, not using the tunnel, because it’s outgoing from your network.

Details of a tunneled application link on the server side.

Still need help?

The Atlassian Community is here for you.