nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

MCP tool getConfluencePage fails with 401 for scoped API Token related to an automation Account

Aslak Niclasen

I've tried to use the Rove MCP server with an automation account via claude code.

I authenticate and the console provides me with the tools that the scopes of the API token should provide access to. In particular it shows that the tool availability of getConfluencePage is present.

Authentication is based on a generated API token with all granular Read & Write scopes, defined in the 'supported tools' page here for confluence:
https://support.atlassian.com/atlassian-rovo-mcp-server/docs/supported-tools/

However when I invoke the tool getConfluencePage to read a page, which stated in the docs require the scope read:page:confluence I get a 401 response back with "Unauthorized; scope does not match"

Strangely enough the same API token works fine on regular the API v2 GET /pages/<pageId> with the same scope requirement.

Even more strange, I can actually read the page with a separate selection of MCP tools available with different or the same scope.
getPagesInConfluenceSpace, getConfluenceSpaces, getConfluencePageDescendants, getConfluencePageFooterComments all return 200

What Am I missing in order to use the tool getConfluencePage since it seems to be available yet when invoked I'm not allowed

Here are some screenshots of the investigations

Best regards

Accepted answers

Gabriela - LeanZero

Hi @Aslak Niclasen, there's no scope left to add. Atlassian's supported-tools table gives getPagesInConfluenceSpace the same requirement as getConfluencePage, read:page:confluence, and that call returns 200 for you, so the scope is on the token and the gateway is accepting it. The 401 is that one tool asking for something the table doesn't list.

The common cause of that exact message is the endpoint, /v1/mcp/authv2 in place of /v1/mcp, which is what this one came down to. Doesn't fit yours. It kills the whole Confluence set in one go, and four of yours answer fine.

So the requirement is either undocumented or wrong. Either way it sits with Atlassian, and atlassian/atlassian-mcp-server on GitHub is where their MCP team triages these. I couldn't find an open issue matching it. Put the getPagesInConfluenceSpace 200 next to the 401 when you file, that pairing is what shows it isn't your config.

All comments

Gabriela - LeanZero

Aslak Niclasen

thanks for the reply - I'll try to file an issue there or go to Atlassian support if our company have the ability to do so

Viswanathan Ramachandran

Echo @Gabriela - LeanZero

Test by temporarily granting the service account's API token the read:confluence-content.all (classic OAuth) scope or adding read:confluence:agent-interface.

Alternatively, verify if updating the MCP connection URL to [https://mcp.atlassian.com/v1/mcp] resolves the underlying pathing issue

https://developer.atlassian.com/cloud/rovo-mcp/preview/api-token-scopes/

Gabriela - LeanZero

Viswanathan, the agent-interface scopes are real but they belong to the preview endpoint, mcp.atlassian.com/v1/mcp/preview. That same page's troubleshooting says a scope error is what you get from GA scopes against preview or the reverse, so adding read:confluence:agent-interface to a GA token won't move this one. Same for the classic scope, Aslak. The gateway is already accepting read:page:confluence on that token, getPagesInConfluenceSpace returns 200 with it.

What's worth reading is the Limitations section of https://support.atlassian.com/atlassian-rovo-mcp-server/docs/configuring-authentication-via-api-token/ : certain tools are disabled because the required product scopes are not currently available when creating personal API tokens or API keys. It names Compass rather than Confluence, so mechanism not proof, but that is the exact shape of yours, tool advertised then 401 on invocation.

The test that settles it is the same page and same account over OAuth 2.1 instead of the API token. If it reads fine there, that pairing is your issue report. Still nothing matching in the repo today.

Viswanathan Ramachandran

@Gabriela - LeanZero makes sense. Thank you for the explanation.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

rovo-atlassian-intelligence

mcp