Connect Confluence as knowledge source Private Preview
Connect Confluence to Atlan through Atlassian's Rovo MCP server so agents can read spaces and pages as context.
You can connect Confluence so that Atlan agents read your spaces and pages. Atlan reads Confluence through Atlassian's Rovo MCP server, the official Atlassian endpoint for AI tools. Setup is one admin toggle, one scoped token, and three fields in Atlan.
Prerequisites
Before you begin, make sure you have:
- An Atlassian organization admin who can enable API token authentication for the Rovo MCP server
- Access to the Confluence account whose permissions the connection is recommended to inherit. A dedicated service account is recommended, see Choosing the account
- Permission to create integrations in Atlan. If you can't see Settings → Integrations, ask a workspace admin or raise a support request
- About 15 minutes
One person holding all three roles can complete this alone.
Three conditions, in this order
The connection works when all three are true, and order matters: the token must be created after the admin setting is enabled, because Atlassian doesn't apply the entitlement retroactively to tokens that already exist.
- Organization admin: API token authentication is enabled for the Rovo MCP server.
- Confluence account: a scoped API token exists with read access to Confluence, created after the toggle was turned on.
- Atlan admin: site URL, account email, and token are entered in Atlan.
Atlan doesn't crawl Confluence, doesn't use the classic Confluence REST API, and can't write to Confluence with this token. Every read is bounded by the permissions of the account whose token you use.
Step 1: Enable API token authentication
- Go to admin.atlassian.com and sign in as an organization admin.
- Open Rovo → Rovo MCP server.
- Select the Authentication tab.
- Turn on Allow API token authentication.
The same tab shows a second toggle, Allow enterprise managed authentication (preview), which routes MCP authorization through your IdP instead of individual user sign-ins. It's not required here. Leave it off unless your security team specifically wants it.
Any API token created before you turn this toggle on keeps failing with a permission error, even once the setting is on. Always create a fresh token afterwards. This is the single most common reason a correct-looking setup fails.
If your organization enforces an IP allowlist, it also governs API token traffic. Ask your Atlan contact for the current egress IPs and add them.
Step 2: Create scoped API token
Create the token as the account whose Confluence permissions the connection inherits. See Choosing the account first, because that choice is your main access-control lever.
- Go to id.atlassian.com/manage-profile/security/api-tokens.
- Click Create API token with scopes. Not the plain Create API token button, which produces a legacy unscoped token that Rovo MCP rejects.
- Give it a recognizable name, for example
Atlan Confluence MCP (read). - Set an expiry. See Rotation and expiry.
- Select the app: Rovo MCP.
- Enable Read access to Confluence.
- Create the token and copy it immediately. Atlassian shows the value once. If you lose it, delete that token and create another.
If your tenant shows individual scopes instead
Some tenants present a granular scope picker rather than a single read toggle. Select exactly these, and no write: scopes:
read:account
read:all:twg
read:page:confluence
read:space:confluence
read:comment:confluence
read:hierarchical-content:confluence
read:whiteboard:confluence
read:confluence:mcp
search:confluence
search:rovo:mcp
Step 3: Enter values in Atlan
- In your Atlan workspace, click Settings from the left sidebar.
- Under Team, click Integrations.
- Click the MCP filter, find Confluence, and click Connect.
- Fill in the three fields:
| Field | What to enter | Example |
|---|---|---|
| Confluence site URL | Your Atlassian site host | your-company.atlassian.net |
| Atlassian account email | The email of the account that created the token in step 2 | atlan-integration@your-company.com |
| Rovo MCP token | The scoped token from step 2 | ATATT... |
- Click Connect.
All three are required. The email isn't cosmetic: Atlassian authenticates the token as email plus token together, so an email from a different account fails even with a valid token.
Paste it straight from Atlassian into Atlan. Don't send it over Slack or email, don't attach it to a ticket, and don't commit it to a repository. If it lands in any of those places, delete the token in Atlassian and create a new one.
Choosing account
Scopes can only narrow access, never widen it. A scoped token is always bounded by the Atlassian permissions of the account that created it, so Atlan can never read a page that account can't already read. That makes the account choice your access-control lever.
| Option | Trade-off |
|---|---|
| A dedicated service account (recommended) | Grant it Confluence access only to the spaces you want Atlan to see. You get space-level control, the connection survives employee departures, and it can be revoked centrally without touching anyone's own access. |
| A personal account (workable) | The connection inherits that person's full Confluence access and breaks when they leave or change teams. A personal token from a broad-access user is a broad-access credential. |
The scope set in step 2 contains no write scopes, so Atlan can't create, edit, or delete Confluence pages or comments. It also carries no Jira, Bitbucket, or Jira Service Management scopes: this token reaches Confluence only.
Rotation, expiry, and revocation
- Expiry. Match your own policy. With no policy in place, 365 days is a reasonable default, plus a calendar reminder two weeks ahead.
- Rotation. Create the new token first, update it in Atlan, confirm the connection succeeds, then delete the old one. Deleting a token stops the connection immediately.
- Revocation. Delete the token at id.atlassian.com to cut Atlan's access. Turning off the organization-level Allow API token authentication toggle revokes all Rovo MCP API token access at once.
- Offboarding. If the token belongs to someone who is leaving, rotate it onto a service account before their Atlassian account is deactivated.
Validate results
After entering the values, confirm the connection works before you rely on it:
- The Confluence card in Settings shows Connected, along with when the credentials were last updated. Atlan verifies the credentials before storing them, so a successful connection means the token authenticated.
- Confluence appears as a selectable source when you create or edit an agent.
- Run a sample run on an agent that uses Confluence. A sample publishes nothing and returns proposed items with citations, so cited results confirm the agent can read your spaces.
A connection can authenticate and still read nothing if the token's account has no access to the spaces you expect, so the sample run is the check that matters. See Troubleshooting.
Troubleshooting
Each prerequisite fails with a different error, so read the error text and match it here rather than repeatedly recreating the token.
| What you see | Cause | Fix |
|---|---|---|
| "You don't have permission to connect via API token. Please ask your organization admin for access." | The organization setting is off, or the token predates it being turned on | Confirm step 1, then create a new token |
| "Legacy API tokens without scopes aren't supported" | Token came from the plain Create API token button | Recreate with Create API token with scopes |
| "Insufficient API token scopes" | Wrong scope family, usually the :agent-interface scopes from a "Rovo MCP V2" picker | Recreate with the Rovo MCP app and Confluence read access |
| Authentication fails with a token you just created | Email and token belong to different accounts | The Atlassian account email must be the account that created the token |
| Connects, but returns no content | The token's account has no access to those spaces | Check that account's Confluence permissions |
Only three tools in a manual tools/list | Scopes too narrow | Same fix as "Insufficient API token scopes" |
| Intermittent empty search results | Atlassian rate-limits bursts of new sessions | Transient, retry. Persistent emptiness is a permissions issue, not rate limiting |
Frequently asked questions
Can this be limited to specific spaces?
Yes, through the token account's Confluence permissions. Grant the service account access only to the spaces you want in scope. There is no space filter on the token itself.
Do Rovo licences need to be purchased?
Rovo MCP is the Atlassian endpoint used for the connection. If the Rovo section is missing from admin.atlassian.com, check with your Atlassian account team.
Can OAuth be used instead of token?
OAuth 2.1 is Atlassian's default for interactive AI tools, but it needs a human to sign in per session. A scoped API token is the supported path for a service integration that runs unattended, including scheduled agent runs.
Is one token enough for multiple Atlassian sites?
The token isn't bound to a site, but each Atlan connection points at one site URL. Set up one connection per Confluence site.
Need help
If you need assistance after reviewing this page, contact Atlan support.
See also
- Knowledge sources: how connections and access work
- Create an agent from a template: use this source in an agent