Connect Confluence

Agent markdown

Before you start

Engine operator registers one Atlassian OAuth 2.0 (3LO) app for Confluence. Connection admin/user consents for their Confluence Cloud site during Connect.

Confluence and Jira remain separately configured Init providers. Use CONFLUENCE_CLIENT_ID / CONFLUENCE_CLIENT_SECRET for this pack—do not assume a Jira app grant covers Confluence content.

You need:

• An Atlassian developer account to create OAuth 2.0 (3LO) apps.
• A Confluence Cloud user who can consent to the requested scopes (space/admin rights may be required for permission APIs).
• The engine public base URL for the callback URL.

Configure the provider

One-time platform Confluence OAuth app (Engine operator)

1. In the Atlassian Developer Console, create an OAuth 2.0 (3LO) app (or a dedicated Confluence configuration separate from Jira).

2. Add the callback URL:

   {FUSE_PUBLIC_URL}/v1/oauth/confluence/callback

3. Enable only the Confluence Cloud scopes required by the Init actions you expose. Do not enable unused Jira scopes on this app unless you deliberately share one client across products.

4. Copy the client ID and client secret into the Fuse environment as CONFLUENCE_CLIENT_ID and CONFLUENCE_CLIENT_SECRET. Never commit these values.

Per-site authorization (Connection admin/user)

Each customer authorizes Confluence access through Init Connect. No personal Confluence API tokens are submitted for this provider.

Connect to Init

1. Connection admin/user starts a Confluence Connect session.
2. Sign in to Atlassian and approve the Confluence scopes for the correct cloud site.
3. Init exchanges the authorization code and stores the connection. No customer credential fields are submitted.

When Init enables additional Confluence actions that need new scopes, reconnect so Atlassian re-consents.

Permissions

Confluence scopes are listed on the generated scope matrix. Space and content restriction APIs may require elevated Confluence permissions for the authorizing user.

Consent is per Atlassian account and selected cloud resource. Content the user cannot view remains inaccessible to Init even after a successful OAuth grant.

Verify the connection

1. Confirm Connect completes and Init shows an active Confluence connection for the expected site.
2. Run a safe read such as listing spaces or searching content the user can access.
3. Success looks like Confluence returning space/page metadata without authorization failures.

Rotate or revoke access

• Rotate platform secrets (Engine operator): rotate the Atlassian client secret, update CONFLUENCE_CLIENT_SECRET, then retire the old secret.
• Revoke customer access (Connection admin/user): remove the app from Atlassian connected apps, or delete the Init connection.
• Scope expansion requires reconnect/reauthorize before newly scoped actions succeed.

Troubleshooting