Apps that store Atlassian personal data must report account IDs via the Personal data reporting API (default 7-day cycle). [3]
Guides · productivity · Popular APIs
Atlassian Jira and Confluence Cloud APIs (API token or OAuth 2.0 3LO app)
Use an Atlassian API token for your own scripts, or create an OAuth 2.0 (3LO) app in the developer console for multi-user access; sharing is opt-in, and a public Marketplace listing needs Atlassian approval.
Researched · not yet run liveLast researched 25 October 2026 · Atlassian · provider site
Researched, not yet run live. Built from the provider’s official pages (linked below). A person hasn’t walked this flow end to end yet, so check each step against the source.
Who owns what
An Atlassian account owns API tokens and developer-console apps; data access follows the user's Jira/Confluence site permissions.
- Atlassian account personal owned by the person
- Jira / Confluence Cloud site organisation
- Marketplace partner developeroptionalOnly for public Marketplace listings.
Steps
Steps marked “human step” are ones only you can do: verapli never signs in, submits, pays or accepts terms for you.
Create an API token (your own scripts)
At id.atlassian.com > Security > API tokens choose Create API token (or with scopes), name it, set an expiry (1-365 days) and copy it once.
verapli captures
ATLASSIAN_API_TOKENhere by plain code: encrypted in your browser, never shown to AI.Where: https://id.atlassian.com/manage-profile/security/api-tokens
Create an OAuth 2.0 (3LO) appoptional
In the developer console select Create > OAuth 2.0 integration, name it and choose the grant type.
Where: https://developer.atlassian.com/console/myapps/
Add scopes and the callback URL
Under Permissions add Jira/Confluence APIs and only the scopes needed; under Authorization set the callback URL exactly as your redirect_uri.
verapli captures
ATLASSIAN_OAUTH_CLIENT_SECREThere by plain code: encrypted in your browser, never shown to AI.If something goes wrong (1)
- Refresh fails with invalid_grant: Refresh tokens rotate and expire after 90 days unused; store the newest one each time, or make the user re-authorise. [1]
Where: https://developer.atlassian.com/console/myapps/
Turn on sharing (Distribution)optional
Apps are private by default. Under Distribution enable sharing; if the app stores personal data it must report it via the Personal data reporting API (default every 7 days).
Where: https://developer.atlassian.com/console/myapps/
Submit for Marketplace approval (public listing)optional
Meet the cloud security requirements, accept the Marketplace Partner Agreement, complete the privacy and security tab and partner verification, then submit.
- The provider says
- Approvals usually take 10-15 business days, depending on submission volume; expect a few review rounds. [5]
Where: https://developer.atlassian.com/platform/marketplace/app-approval-guidelines/
Terms and gotchas
Plain-English summary, not legal advice. Each card links its source.
Shared but unreviewed 3LO apps show users a warning that Atlassian has not approved them. [1]
What you end up with
| Env var | Secret | Format | What it is |
|---|---|---|---|
ATLASSIAN_EMAIL | not secret | you@example.com | Atlassian account email used with the API token for basic auth |
ATLASSIAN_API_TOKEN | secret | opaque token string | Atlassian account API token |
ATLASSIAN_OAUTH_CLIENT_ID | not secret | opaque id string | 3LO app client ID |
ATLASSIAN_OAUTH_CLIENT_SECRET | secret | opaque secret string | 3LO app client secret |
For agents
The same entry as JSON: /api/v1/entries/atlassian/jira-confluence · requirements /api/v1/requirements/atlassian/jira-confluence · terms /api/v1/terms/atlassian/jira-confluence.
Remote MCP (read-only, no auth)
claude mcp add --transport http verapli https://verapli.com/mcp
> "What do I need for Atlassian Jira and Confluence Cloud APIs (API token or OAuth 2.0 3LO app), and how long will it take?"
→ tools/call requirements { "provider_id": "atlassian/jira-confluence" }Sources
- OAuth 2.0 (3LO) apps Developer console Create > OAuth 2.0 integration; Permissions to add APIs and scopes; Authorization to set callback URL; apps private by default, Distribution to enable sharing; unreviewed-app warning; offline_access for rotating refresh tokens that expire after 90 days of inactivity. · accessed 25 October 2026 · official
- Manage API tokens for your Atlassian account Create at id.atlassian.com; expiry 1-365 days, default one year; scoped tokens via api.atlassian.com/ex/{product}/{cloudId}; basic auth with email + token. · accessed 25 October 2026 · official
- User privacy guide for app developers Apps storing personal data must report it via the Personal data reporting API; default cycle 7 days. · accessed 25 October 2026 · official
- Security requirements for cloud apps Marketplace Partner Agreement; security requirements (TLS 1.2+, encrypt data at rest, least privilege, security contact); 3LO apps must encrypt OAuth secrets and validate state. · accessed 25 October 2026 · official
- App approval guidelines New public listings need approval; usually 10-15 business days; privacy and security tab, partner verification ticket; privacy policy; basic auth not acceptable for public apps. · accessed 25 October 2026 · official
Provider rules change. This page is generated from verapli registry version 2026.1025.387; spotted something out of date? Tell us. Atlassian is not affiliated with verapli.