Fix OAuth consent block for Atlassian Rovo MCP server in Atlassian Cloud

Summary

This article helps resolve OAuth consent errors when connecting tools like Claude Code to the Atlassian Rovo MCP server, even when domain settings appear correct. This issue affects Atlassian Cloud environments.

Diagnosis

An error is observed like "Your organization admin must authorize access from this redirect URL" or a permission issue when using API tokens with the Atlassian Rovo MCP server

Cause

The issue occurs when API token authentication is disabled at the organization level, requiring OAuth. Additionally, the OAuth flow may be blocked if the redirect URL (such as localhost) is not properly allowlisted or if the domain settings in the Admin UI have not fully committed to the backend configuration.

Solution

To resolve this issue, use the following steps to configure OAuth correctly.

Verify authentication method

The Atlassian Rovo MCP server uses OAuth 2.1 as its primary authentication method. API tokens are an advanced method that must be explicitly enabled by an organization admin. If API tokens are disabled, you must use OAuth.

1. Update your .mcp.json configuration file to remove the headers block.

2. Ensure the url points to the correct endpoint (e.g., /v1/mcp).

3. Initiate the connection in your tool (e.g., type /mcp in Claude Code) to trigger the browser-based OAuth login flow.

Allowlist the redirect URL

If the OAuth flow is blocked by a consent screen, your organization admin must allowlist the specific redirect URL being used by your local tool.

1. Go to Atlassian Administration, then Rovo, and select Rovo MCP server.

2. Navigate to Domain settings.

3. Add the required redirect URL to the allowed domains list. For local tools, this is often http://:*/** (using a single asterisk for the port and double asterisks for the path).

Force backend configuration update

In some cases, the domain may appear correctly in the Admin UI but may not have fully committed to the backend enforcement service. If the error persists after adding the domain, perform the following steps:

1. Go to Atlassian Administration, then Rovo, and select Rovo MCP server.

2. In the Domain settings section, remove the existing custom domain entry that is causing the block.

3. Re-add the exact same domain entry and save the changes.

4. Open a fresh incognito or private browser window and retry the OAuth flow to ensure no cached state interferes with the connection.