Authentication for Apps

YouTrack runs the scripts contained in an app package within its own JavaScript runtime. This means you don't need to provide any extra authentication details in your scripts.

Installing and updating apps from JetBrains Marketplace require the Low-level Admin Write permission. Uploading a custom app package to YouTrack requires either the global Update Project permission or the system Low-level Admin Write permission. For development and testing, the upload command generated by the YouTrack app generator can use a permanent token for an account with Update Project permission. To attach project-level app modules to projects, you need Update Project permission for the corresponding projects. For details, see Upload the App to YouTrack and Permissions.

Widget scripts that use the Host API are authenticated by YouTrack as the current user. For example, requests sent with host.fetchYouTrack() use the user's YouTrack session and don't require an authorization header in the widget code.

If you send requests to the YouTrack REST API or the Hub REST API outside the Host API, follow the authentication guidelines for these APIs. For details, see YouTrack REST API, Hub REST API, and Users, Groups, and Access Management.