nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Attachment dowload authentication

blatzfab

I am trying to download an attachment from a page like this:

```

import requests
base_url = f"https://api.atlassian.com/ex/confluence/{CLOUD_ID}/wiki"
r = requests.get(base_url + "/download/attachments/625121497/some_document.docx?version=1&modificationDate=1761906726977&cacheVersion=1&api=v2", auth=(EMAIL, SCOPED_API_KEY))
```

With a scoped api key this fails and returns a `401: wrong scope` response. Despite having literally every `read:` permission set on the token.

When using the same request with a classic token, it just works.

Accepted answers

All comments

Tudor Tofan

Hi @blatzfab

HTTP 401 is according to Atlassian: Returned if the authentication credentials are incorrect or missing from the request.

Are you encoding the username and the API key into base64?

Generally, I use a tool like https://www.base64encode.org/ and in the text area I use the following syntax: "email-address:API-token"

Tudor Tofan

Also, checking the scoped API keys, I'm not seeing anywhere the Confluence option. Maybe this is also a problem

Screenshot 2025-11-06 152027.png

blatzfab

Hey @Tudor Tofan ,

when I add logging to the requests library and inspecting the headers - yes they are base64 encoded. This is also completely reproducible with curl:

curl -s -o /tmp/FFF -L -w "%{http_code}\n" -u "MY-EMAIL:MY-SCOPED-TOKEN" \
"https://api.atlassian.com/ex/confluence/MY_CLOUD_ID/wiki/download/attachments/625121497/some_document.docx?version=1&modificationDate=1761906726977&cacheVersion=1&api=v2"

Scoped token does not work, classic token works.

Tudor Tofan

Hi @blatzfab , please see my other comment. You are using a Confluence end point and Scoped API tokens do not have a Confluence option, per my screenshot above.

blatzfab

I do have this option:
Image 2025-11-06-003.png Image 2025-11-06-004.png

Tudor Tofan

I've done some research and the endpoint you are using is found in some older Connect APIs, but it's not found in the official Confluence REST API documentation: https://developer.atlassian.com/cloud/confluence/rest/v2/intro/#about

Maybe this is why, when using a Scoped API, you don't have the necessary permissions available for it.

Also, as a sidenote, I suggest you switch to the endpoints used by the official REST API documentation, since Connect will be shut down in the near future: https://www.atlassian.com/blog/developer/announcing-connect-end-of-support-timeline-and-next-steps

blatzfab

I do not quite understand why the Connect stuff should matter here. I am using the official API to list the pages attachments:
The Confluence Cloud REST API

and then getting the link in "_links/download" and then appending it to the base url.

As for authentication the docs also state that basic auth with the API token shall be supported:
https://developer.atlassian.com/cloud/confluence/security-overview/#scripts-and-other-rest-api-clients

Jensen Buck

I am having the same issue as @blatzfab -- what I want to do is programmatically download the contents of the attachments. Your suggestion to use the "Get attachment by id" endpoint does not solve this.

What I am experiencing is that I can use my credentials to use the Confluence endpoints just fine. I can get the content via page_id, get the list of attachments, etc. However, when attempting to programmatically download using the download links, I get a 401 error.

This only started yesterday for me. Two days ago, it was fine. The same code allowed me to download the attachments. I'm using the same session with the same auth to do all of the calls.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

confluence

cloud

confluence-cloud