Use an Atlassian service account for Jira, Jira Service Management, and Confluence workflows. One credential can serve all three products on the same site when its account access and token scopes cover each product.
Setting up Search? Follow the Confluence Search service-account guide for its content and permission scopes. Jira Search uses each teammate's OAuth account; a workflow service account does not replace that connection.
Create the account and token
An Atlassian organization admin completes these steps:
- Open Atlassian Administration, select the organization, then Directory → Service accounts → Create service account.
- Give the account access to the intended site's Jira and/or Confluence apps. Grant the project and space permissions its workflows need, including access to restricted content.
- Select the service account, then Create credentials → API token → Next.
- Name the token, set an expiry between 1 and 365 days, and select Next.
- Select the scopes below for the products and operations you need. Review and create the token, then copy it. Atlassian shows it only once.
See Atlassian's service-account setup and token instructions.
Choose scopes
Start with the connection and read scopes for each product, then check the scope requirements for your workflow operations.
Jira and Jira Service Management
read:jira-user
read:jira-workread:jira-user covers the current-user check when you add the credential, including through Jira Service Management. Add read:servicedesk-request for Service Management requests.
Confluence
read:confluence-user
read:confluence-content.all
read:confluence-space.summary
read:space:confluence
read:page:confluenceread:confluence-user covers the current-user check. The space picker needs read:space:confluence; page reads and the page picker need read:page:confluence.
Workflow actions
Add scopes for the actions your workflow performs:
| Actions | Scopes to add |
|---|---|
| Create or update Jira issues | write:jira-work |
| Create or update Service Management requests | write:servicedesk-request |
| Manage Service Management customers | manage:servicedesk-customer |
| Create or update Confluence pages | write:confluence-content, write:page:confluence |
Deletes, webhooks, Assets, and other operations can require additional scopes. Check the endpoint's complete scope set in the Jira, Jira Service Management, or Confluence API reference.
Use the App and Scope type filters to find both classic and granular scopes. Scopes and account permissions are separate: the account must also have access to the project, space, or content.
Add the credential to Sim
- Open Integrations in your workspace sidebar, then Jira, Jira Service Management, or Confluence.
- Select Add to Sim → Add service account. If only service accounts are available, select Add service account directly.
- Paste the API token and enter Site domain, such as
your-team.atlassian.net. Omithttps://and any path. Optionally add a display name and description. - Select Add service account. Sim checks the token against the selected product's current-user endpoint; resolve any error before continuing.
- In your workflow's Jira, Jira Service Management, or Confluence block, select the credential and configure the operation.
The credential appears on all three integration pages, but adding it only validates the selected product. Check account access and scopes before using another product.
Troubleshooting and rotation
| Problem | What to check |
|---|---|
| Cannot add the credential | Use a scoped API token from Directory → Service accounts, verify its expiry and site, and include the selected product's current-user scope above. |
| Empty or failed picker | Include read:jira-work for Jira projects or read:space:confluence for Confluence spaces, and grant the account access to the selected site and content. |
| A workflow returns a scope or permission error | Check the operation's full scope list and the account's project/space permissions. Successful connection does not validate every operation. |
| Token expires or needs different scopes | Create a replacement token, add it as a new Sim service-account credential, and select it in the affected workflows. Test them before revoking the old token. Sim does not refresh pasted API tokens. |
| Data Center or Server host | This credential supports Atlassian Cloud only. |
For a Search source, follow Confluence's indexing-account replacement steps.