Are there any custom notifications sent when API tokens are about to expire?

Question

Since API tokens will all have an expiration date of a year from now on, will admins be notified ahead of time that we need to renew? Can we do custom notification? Any workaround we can do?

I refer below question from last year, maybe it has latest update on this

Are notifications sent when API tokens are about to expire? - Atlassian

Shaik Riyaz · Answer

Hi @Nasman Hakimi

No, Atlassian does not currently send native alerts (to admins or token owners) before API tokens expire, and there are no native webhook/automation triggers to build custom alerts directly in Jira.

Workarounds to handle this:

* Credential Vault / Secrets Manager: Store tokens in Azure Key Vault, AWS Secrets Manager, or HashiCorp Vault with expiration alerts set for 30 days prior.
* Jira Automation Reminder: Create a tracked Jira task when a token is issued, set the Due Date to 11 months, and use a scheduled automation rule to notify your team before it lapses.

Thanks!!

Germán Morales · Answer

Hi @Nasman Hakimi, welcome to the Community!

Adding to @Gaurav Arora answer , here's the exact endpoint for that workaround, since it's the piece that's easy to miss:

GET https://api.atlassian.com/admin/api-access/v1/orgs/{orgId}/api-tokens

It returns the user API tokens in your organization, each with its expiresAt date and the owner (user.name, user.email). It needs an Atlassian Administration API key that includes the read:tokens:admin scope. With that, a scheduled script can pick out the tokens expiring in the next 30 days and email the owners or post to your admins' channel.

Reference: Get all API tokens in an org

If you'd prefer a no-script option in the future, there's also a suggestion to let Automation for Atlassian Administration use token expiry dates: AUTO-2302. Worth voting for it together with ID-8781.

Gaurav Arora · Answer

Hi there,

Unfortunately, the behavior discussed in that thread from last year hasn't changed yet. Here is the current state of API token notifications:

* Admin Notifications: No, Organization and Site Admins are not notified when a user or service account API token is about to expire. The automated expiration warning is only sent to the email address of the individual user who created the token.
* Custom Notifications: Currently, there is no native way to configure custom notifications. You cannot change how far in advance the alert is sent, nor can you add a distribution list or webhook to the built-in alert.

Workarounds: Since native admin alerts aren't available, the most reliable workaround is to use external scripting. You can use the Atlassian Admin REST API to periodically pull your organization's users and their API token metadata (which includes the expiration dates).

By running a scheduled script (e.g., via Google Scripts), you can parse those expiration dates and push custom alerts to a Slack channel, Microsoft Teams, or an admin email group when tokens are 30, 15, or 7 days out from expiring.

Feature Request: Atlassian is actively tracking the demand for admin notifications. I highly recommend voting for and watching this specific issue to get updates on its progress: ID-8781: API Token Expiry alert notifications for Organization Admins

Hope this helps clarify the current options!