Jira DevOps Integration Failing with 401 Unauthorized Error - OAuth API Script and Redirect URL Mismatch - Support and Troubleshooting

Jira DevOps Integration Failing with 401 Unauthorized Error - OAuth API Script and Redirect URL Mismatch Issue .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Jira DevOps integration with ServiceNow using OAuth (3LO) authentication fails with 401 Unauthorized errors when attempting to retrieve authentication tokens. Integration cannot be established between Jira Cloud and ServiceNow.

Symptoms .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } When attempting to configure Jira DevOps integration in ServiceNow:

Authentication fails with HTTP 401 Unauthorized error Token retrieval requests fail consistently OAuth validation throws "Can't find matched state" error Integration testing fails at the authentication stage Multiple state parameters are sent to Atlassian, but validation fails on ServiceNow side HAR file analysis shows conflicting OAuth parameters being passed to Jira Release .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } This issue affects ServiceNow Jira DevOps integrations using OAuth (3LO) authentication across all releases where OAuth is configured with conflicting API scripts and redirect URLs.

Cause .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } The root cause is a configuration mismatch in the Application Registry record for the Jira OAuth application. Specifically:

Conflicting Configuration:

OAuth API Script is set to OAuthJiraUtil (designed for ServiceNow's Atlassian proxy flow) Redirect URL is configured to a direct redirect ( https://instancename.service-now.com/oauth_redirect.do ) instead of the proxy URL Why This Fails: OAuthJiraUtil is a specialized script that adds its own state parameter intended for the proxy to consume. When combined with a direct redirect URL (not proxy), the OAuth flow becomes misconfigured:

OAuthJiraUtil adds a state parameter for proxy consumption Direct redirect sends both the proxy state and platform state to Atlassian Atlassian returns only the first state value Platform validates against its own cached state State mismatch occurs — validateState fails with "Can't find matched state" Atlassian rejects the request with 401 Unauthorized The Two Scenarios: The issue occurs when configurations are mixed between two valid OAuth deployment models:

Dedicated Jira App (uses direct URLs with OAuthUtil) OOB Shared Jira App (uses proxy URLs with OAuthJiraUtil) Using OAuthJiraUtil with direct redirect URLs violates the dedicated app model and causes authentication failure.

Resolution .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Identify which Jira OAuth deployment model you are using and configure accordingly:

Solution 1: For Dedicated Jira Cloud Application If you have created a dedicated OAuth application in Jira Cloud:

Navigate to System OAuth > Application Registry Open the Jira OAuth application record Update the following fields: Field Value OAuth API Script OAuthUtil (platform default) Token URL https://auth.atlassian.com/oauth/token Refresh Token URL https://auth.atlassian.com/oauth/token Token Revocation URL https://auth.atlassian.com/oauth/token Redirect URL https://instancename.service-now.com /oauth_redirect.do Save the changes Test the OAuth flow — token retrieval should now succeed Solution 2: For OOB Shared Jira Cloud Application (with Proxy) If you are using ServiceNow's shipped/OOB shared Jira application:

Navigate to System OAuth > Application Registry Open the Jira OAuth application record Update the following fields: Field Value OAuth API Script OAuthJiraUtil (shared app requirement) Token URL https://auth.atlassian.com/oauth/token Refresh Token URL https://atlassianproxy.service-now.com/jira/spoke/refresh/token Token Revocation URL https://atlassianproxy.service-now.com/jira/spoke/refresh/token Redirect URL Leave as configured for proxy Save the changes Test the OAuth flow — proxy will handle state parameter validation How to Determine Which Model You Are Using: Dedicated App: You created a custom OAuth application in your Jira Cloud account and have control over client credentials and API permissions OOB Shared App: You are using ServiceNow's pre-configured Jira integration without creating your own application Important Notes: Do NOT mix configurations (OAuthJiraUtil with direct URLs or OAuthUtil with proxy URLs) OAuthJiraUtil is exclusively for the proxy flow and adds its own state parameter management OAuthUtil is the platform default for direct OAuth flows If you need to change grant type from Authorization Code to Client Credentials, refer to Jira OAuth documentation