Scoped API Token returns Unauthorized for simple query

Luis Blanche

Hi, I am trying to use the Confluence API, end while everything works when I am using an API token without scope, whenever I try to switch to a scope token I get 401  Unauthorized errors. 

Here is an exemple from i took from the API doc :

import json

import os

import requests

from requests.auth import HTTPBasicAuth

url = f"https://{your_domain}/wiki/api/v2/pages/{page_id}"

auth = HTTPBasicAuth(my_email, os.getenv("CONFLUENCE_API_TOKEN_READ_PAGE"))

headers = {"Accept": "application/json"}

response = requests.request("GET", url, headers=headers, auth=auth)

print(json.dumps(json.loads(response.text), sort_keys=True, indent=4, separators=(",", ": ")))



So when I set  CONFLUENCE_API_TOKEN_READ_PAGE to my token without scopes this works and returns 200

But when I create a scoped token with scope : read:page:confluence

Then i get a 401 Unauthorized HTTP Error. 

I am following the snippet from the doc almost exactly and the only thing that changes between the working version and the failing one is the Token. 

 

Oliver Siebenmarck {Polymetis Apps}

Hi @Luis Blanche ,

Welcome to the community!

The scoped API tokens are relatively new and unfortunately not well-documented. One particular difference to the unscoped tokens is how the endpoint URL is constructed. Whereas unscoped tokens use an endpoint like the one you tried, the scoped tokens need endpoints constructed like this:

https://api.atlassian.com/ex/confluence/{cloudid}/{api} 

There's a bit more info on this type of endpoint available here, but please not that the endpoint should be the only change you need to make to your code.

As for obtaining the cloudid, the approach outlined in the OAuth documentation did not work for me, I typically just inspect traffic from Confluence's UI to the backend and look for GraphQL calls: they often include the cloudid. I am sure there other ways, but I do not know a more convenient one.

Anyway hope that helps and props for using a scoped token! Security matters and scoped tokens are a fantastic way to reduce risk.

Best regards,
 Oliver from Polymetis Apps