Skip to main content
You need administrator access to your Atlassian organization to create an OAuth 2.0 (3LO) integration and grant it Confluence API scopes.

​
Create an OAuth 2.0 (3LO) integration

Register a new integration in the Atlassian Developer Console. This is what issues the Client ID and Client Secret that StackOne uses.

1

Sign in to the Developer Console

Sign in with the Atlassian account that administers your organization.

  • Open the Atlassian Developer Console.
  • Use an account with administrator access — creating an integration and granting API scopes both require it.
2

Create a new integration

On the My apps page, click Create and choose OAuth 2.0 integration.

The My apps page in the Atlassian Developer Console with the Create button highlighted
3

Enter the integration details

Fill in the Create a new OAuth 2.0 (3LO) integration form.

  • Enter a Name for the integration (for example, StackOne Integration).
  • For Access type, select Resource-level — it restricts access to the specific site the user selects during authorization.
  • Select Account-level only if you need one connection to reach every site in the Atlassian account.
  • Tick I agree to be bound by Atlassian’s developer terms. and click Create.
  • Atlassian shows a Rotating refresh tokens are enabled notice. This is expected — StackOne stores the new refresh token each time it renews the access token.
The Create a new OAuth 2.0 (3LO) integration form with Name, Access type, terms checkbox and Create button highlighted

​
Grant the Confluence API scopes

An integration starts with no permissions. Add the Confluence API and enable the scopes the connector’s actions need.

1

Add the Confluence API

In the left sidebar click Permissions, find the Confluence API row, then click Add. Once it is added the button changes to Configure — click it.

The Permissions page with the Confluence API row and its Configure button highlighted
2

Enable the required scopes

Enables actions: Create Attachment, Create Attachment Labels, Create Blog Post, Create Blog Post Labels, Create Blog Post Property, Create Database, Create Folder, Create Footer Comment, Create Inline Comment, Create Page, Create Page Labels, Create Page Property, Create Smart Link In The Content Tree, Create Space, Create Space Property In Space, Create Whiteboard, Delete Attachment, Delete Attachment Label, Delete Blog Post, Delete Blog Post Label, Delete Blog Post Property, Delete Database, Delete Folder, Delete Footer Comment, Delete Inline Comment, Delete Page, Delete Page Label, Delete Page Property, Delete Smart Link In The Content Tree, Delete Space, Delete Space Default Classification Level, Delete Space Property By Id, Delete Whiteboard, Download Unified File, Get Account IDs Of Likes For Blog Post, Get Account IDs Of Likes For Footer Comment, Get Account IDs Of Likes For Inline Comment, Get Account IDs Of Likes For Page, Get Anonymous User, Get Attachment By Id, Get Attachment Comments, Get Attachment Labels, Get Attachments, Get Attachments For Blog Post, Get Attachments For Custom Content, Get Attachments For Label, Get Attachments For Page, Get Blog Post By Id, Get Blog Post Classification Level, Get Blog Post Labels, Get Blog Post Properties, Get Blog Post Property By ID, Get Blog Post Versions, Get Blog Posts, Get Blog Posts For Label, Get Blog Posts In Space, Get Children Footer Comments, Get Children Inline Comments, Get Current User, Get Custom Content Comments, Get Custom Content Labels, Get Database, Get Database Classification Level, Get Folder, Get Footer Comment By Id, Get Footer Comments For Blog Post, Get Footer Comments For Page, Get Group Memberships For User, Get Inline Comment By Id, Get Inline Comments For Blog Post, Get Inline Comments For Page, Get Like Count For Blog Post, Get Like Count For Footer Comment, Get Like Count For Inline Comment, Get Like Count For Page, Get Multiple Users Using IDs, Get Page, Get Page Ancestors, Get Page Children, Get Page Classification Level, Get Page Labels, Get Page Properties, Get Page Property By ID, Get Page Versions, Get Pages For Label, Get Pages In Space, Get Smart Link In The Content Tree By Id, Get Space By Id, Get Space Content Labels, Get Space Default Classification Level, Get Space Labels, Get Space Permissions Assignments, Get Space Properties In Space, Get Space Property By Id, Get Space Role Mode, Get Spaces, Get Task, Get Unified Credentials, Get Unified Drive, Get Unified File, Get Unified Folder, Get Unified Group, Get Unified Role, Get Unified User, Get User, Get User Email Address, Get User Email Addresses In Batch, Get Whiteboard By Id, Get Whiteboard Classification Level, List Classification Levels, List Footer Comments, List Inline Comments, List Labels, List Pages, List Tasks, List Unified Drives, List Unified Files, List Unified Folders, List Unified Groups, List Unified Resource Types, List Unified Resource Users, List Unified Roles, List Unified Users, Reset Blog Post Classification Level, Reset Database Classification Level, Reset Page Classification Level, Reset Whiteboard Classification Level, Update Blog Post, Update Blog Post Classification Level, Update Blog Post Property, Update Database Classification Level, Update Footer Comment, Update Inline Comment, Update Page, Update Page Classification Level, Update Page Property, Update Page Title, Update Space, Update Space Default Classification Level, Update Space Property By Id, Update Task, Update Whiteboard Classification Level, Upload Unified File

Open the Granular scopes tab and click Edit Scopes. Use Search by name or code to find each scope below by its Code, tick it in the Select column, then save.

  • Stay on the Granular scopes tab — the connector requests granular scopes, not the ones on the Classic scopes tab.
  • The read scopes alone are enough for a read-only integration. Leaving a scope out only affects the actions that need it — those return a permission error while the rest of the connector keeps working.
  • read:email-address:confluence is also governed by your site’s external user data privacy setting. If that setting hides email addresses, the email fields come back empty even with the scope granted.
The Confluence API scopes screen with the Granular scopes tab, the search box and the Edit Scopes button highlighted

​
Register the callback URL

Atlassian only completes an authorization if the callback URL is registered on the integration first.

1

Add the StackOne callback URL

In the left sidebar click Authorization, then click Add on the OAuth 2.0 (3LO) row. Paste the StackOne callback URL into Callback URLs and click Save changes.

  • Callback URL: https://api.stackone.com/connect/oauth2/callback
  • Enter it exactly as shown — a trailing slash or a different host makes the authorization fail.
The OAuth 2.0 authorization code grants screen with the Callback URLs field and Save changes button highlighted

​
Copy the client credentials

The last step reads the two values StackOne needs from the integration.

1

Copy the Client ID and Secret

In the left sidebar click Settings and scroll to Authentication details. Use the copy button beside each value.

  • Client ID — the public identifier of your integration, shown under Client ID. Paste it into the Client ID field in StackOne Hub.
  • Client Secret — shown under Secret. Paste it into the Client Secret field in StackOne Hub.
  • Store the secret securely. If it is lost you can rotate it here, but rotating invalidates every connection using the old value.
  • OAuth Scopes — leave this field in StackOne Hub empty to request every scope listed above. Set it only to narrow the request to a smaller subset, and make sure each scope you list is also enabled on the integration.
The Settings page Authentication details section with the Client ID and Secret fields and their copy buttons highlighted

​
Add an organization API key

Only needed for the unified IAM organization actions. They read from the Atlassian organization admin API, which uses its own key rather than the OAuth app.

1

Create the organization API key

Create the key in Atlassian administration under Settings, API keys. This is issued at the Atlassian organization level and requires organization admin access, so it is separate from the OAuth integration you just created.

  • Paste it into the Organization Admin API Key field in StackOne Hub.
  • Leave the field empty if you do not need List Unified Organizations or Get Unified Organization. Calling either without the key returns an error naming it; nothing else in the connector is affected.

​
Linking the Account from the Hub

1

Navigate to the Hub

Use one of the three Linking Account Methods to access the Hub.
2

Fill out the fields

Fill out the following fields using details from your provider:
  • Client ID
  • Client Secret
  • OAuth Scopes (Optional)
  • Organization Admin API Key (Optional)
3

Connect

  • Click Connect
  • If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider’s authorization flow.
  • Once authorization is successful, you will see a confirmation popup

If the account linking is successful, you will see the newly linked account in your Accounts page.