API token longer than 1 year?

[Chris Berry]

Hi,

I'm using api calls for some of my automation. When I got my api token from id.atlassian.com, I noticed it said it was only valid for up to 1 year.

Is there a way to extend that? That means in 1 year, I will have to find and go through all of my automation rules that use that one api token and change it out for the new one.

If not, is there a way to change them out so that in an efficient manner?

[Mikael Sandberg]

Currently it is not possible to extend the token past the 1 year expiration, and there is currently no way of updating them centrally. There is a suggestion to add a secret store that you can vote and follow, see AUTO-1365.

One option that I looked at was to store the token as a project property, but the downside of that is that it can be accessed anonymously. If that is not a concern that would work since you can access it as a smart value in automations.

[Aaron Pavez _ServiceRocket_]

Hi @Chris Berry 

Sadly no. One year its the maximun

After December 15, 2024, we set new API tokens to expire in one year by default. When you create an API token, you can set the expiration date to be from one day up to one year.
After March 13, 2025, we set API tokens you created before December 15, 2024 to expire in one year. These API tokens will expire between March 14 and May 12, 2026.

https://support.atlassian.com/atlassian-account/docs/manage-api-tokens-for-your-atlassian-account/

You can do this in bulk using the automation API:

https://developer.atlassian.com/cloud/automation/rest/api-group-rule-management/#api-rest-v1-rule-ruleuuid-get

Once you get the rule, you will see the web request action like this:

component": "ACTION",
"schemaVersion": 1,
"type": "jira.issue.outgoing.webhook",
"value": {
"url": "https://api.atlassian.com/jsm/assets/workspace/d4d2de5d-14ce-4b2d-8a18-3a9cdb177a22/v1/object/1022",
"headers": [
{
"id": "_header_1776949402080",
"name": "Authorization",
"value": "Basic asdlkasgdk1y2837123egiqywugeiawqu67teqweqw", -> this is what you need to change
"headerSecure": false

To make this easier, copy the whole body and change the encoded base64 api

I just added a bunch of "aaaaa" for this example.  

{

"id": "_header_1776949402080",

"name": "Authorization",

"value": "Basic aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",

"headerSecure": false

}

Regards

[Mikael Sandberg]

@Aaron Pavez _ServiceRocket_ I like the idea of using the API to change it, the only downside is that you would have to keep track of your automations that are using tokens. And correct me if I am wrong, but if you are hiding the header this would not work correct?

[Aaron Pavez _ServiceRocket_]

Hi @Mikael Sandberg 

You still get the encoded API. 

"headerSecure": false changes to "headerSecure": true and hides it in the UI only.

Regards