Atlassian Service Accounts

Use an Atlassian service account with a scoped API token to connect Jira, Jira Service Management, and Confluence. Grant the account access to the products, projects, and spaces your workflows need.

One service account covers all three products. You add it once, and it appears as a connected credential on the Jira, Jira Service Management, and Confluence integration pages alike — there is no separate credential to create per product.

Prerequisites

You need an Atlassian organization admin to create the service account. Service accounts are an Atlassian organization-level feature — they cannot be created from a regular user account.

Setting Up the Service Account

1. Create the Service Account

Open admin.atlassian.com and go to Directory → Service accounts

Click Create service account, give it a name (e.g. sim-jira-bot), and finish creation

Grant the service account access to the Atlassian sites and products it needs. Open the service account, go to Product access, and add Jira and/or Confluence on the relevant site

The service account inherits permissions from the project/space roles you grant it — exactly like a human user. If a workflow needs to write to a specific Jira project, give the service account write access to that project in Jira's project settings.

2. Create a Scoped API Token

From the service account's page in admin.atlassian.com, open the API tokens tab and click Create API token

Choose API token as the authentication type (not OAuth 2.0 — Sim uses the API token flow)

Select the scopes the token needs. The minimum set Sim's Jira and Confluence blocks expect is:

Jira (classic):

read:jira-user
read:jira-work
write:jira-work

Jira Service Management (classic):

read:servicedesk-request
write:servicedesk-request
manage:servicedesk-customer

Confluence (classic and granular):

read:confluence-content.all
read:confluence-space.summary
write:confluence-content
read:page:confluence
write:page:confluence

Add more scopes only if you need the corresponding operations (delete, manage webhooks, etc.). The full list of scopes Sim's blocks may use is documented in Atlassian's developer reference.

Prefer the classic scopes above over granular equivalents. Atlassian enforces an endpoint's granular scope list as all-or-nothing, so a token built from a partial granular set fails with Unauthorized; scope does not match even though each individual scope was granted. The classic scopes each cover their product's endpoints on their own. If your organization only permits granular scopes, include every scope listed for each endpoint in Atlassian's reference — Jira Service Management request operations also require read:user:jira.

Use the App and Scope type filters to narrow the list to the scopes you need. Filter by App: Jira (or Confluence) and Scope type: Classic to find the three core Jira scopes; switch to Granular if your org doesn't expose Classic.

Copy the token when it is shown and record its expiration date in Atlassian Administration. Create a replacement before it expires; Sim does not refresh a pasted API token.

The API token is bearer credentials for the service account. Treat it like a password — do not commit it to source control or share it publicly. Sim encrypts the token at rest.

3. Find Your Site Domain

Enter only the host from your Jira or Confluence URL, such as your-team.atlassian.net; omit https:// and any path.

Adding the Service Account to Sim

Open Integrations in your workspace sidebar

Open Jira, Jira Service Management, or Confluence — any of the three works, since they share one service account

Click Add to Sim and choose Add service account

Paste the API token, enter the site domain (e.g. your-team.atlassian.net), and optionally set a display name and description

Click Add service account. Sim resolves the site and checks the token against the selected product's identity endpoint. Review any connection error before continuing.

The token, domain, and discovered cloudId are encrypted before being stored.

Once added, the credential is listed under Connected on all three Atlassian integration pages. It is named after the service account's own Atlassian display name, so several service accounts on the same site stay easy to tell apart.

Using the Service Account in Workflows

Add a Jira, Jira Service Management, or Confluence block to your workflow. In the credential dropdown, your Atlassian service account appears alongside any OAuth credentials. Select it and configure the block as you normally would.

The block calls Atlassian's API gateway (api.atlassian.com/ex/jira/{cloudId}/...) using the service account's token. There's no impersonation step — the service account acts as itself, with whatever permissions you granted it in admin.atlassian.com.

Common Questions

No. Service accounts are an Atlassian organization-level feature and only an organization admin can create them.

Yes — one service account covers all three. Give it access to each product you need on your site, include scopes for each when you create the API token, then connect it once in Sim. It appears as a connected credential on all three integration pages and can be selected from any of their blocks.

Either widen the token's scopes (revoke it and create a new one with more scopes), or grant the service account higher project/space roles in Jira or Confluence. Scope failures look like 401/403 errors with descriptive messages.

Create a new token from the same service account in admin.atlassian.com, update the credential in Sim with the new token, and once it's working, revoke the old one.

No. This credential supports Atlassian Cloud through api.atlassian.com. It cannot connect to an Atlassian Data Center host.