An Atlassian API token acts as a real user on Jira and Confluence. Whoever holds it can read and change tickets, pages and attachments that this user can see, and in many setups reach the repositories and build data that Atlassian products link to. Because the token belongs to a person rather than an application, its reach is often wider than the task it was made for. Revoke it first, then check what the account did while the value was exposed.
Check your GitHub account for leaked secrets — free
- Provider
- Atlassian
- Severity
- Critical
- Impact
- Source code and build access
- Checked live by LeakWatch
- No
What an Atlassian API Token looks like
Current Atlassian API tokens start with the fixed prefix ATATT3, followed by a long run of letters, digits, underscores, dashes and equals signs. Masked, the shape is:
ATATT3…XXXX Atlassian API token (masked)
The prefix makes a hit reliable. Older Atlassian tokens do not have it. They are shorter, have no prefix, and are identified only by a word such as atlassian, confluence or jira sitting next to the value. If your leaked value is one of those, the same steps apply, but check the variable name in the file to see which product it was meant for. Atlassian also has organization-level API keys and service account tokens, which are managed in other places. Treat any of them as a separate credential and check whether they also appeared.
How Atlassian API Tokens get leaked
- Integration configuration. A
.envfile or a settings module for a Jira or Confluence integration, committed with the token filled in. - Automation scripts. A script that creates tickets or exports pages, with the token written in the file for convenience.
- Command-line examples. A curl command in a README or a wiki page that shows the token in the authorization header.
- Pipeline variables written to files. A build step that writes the token into a config file and then publishes the directory.
- Shared notebooks and tickets. A pasted script or log that still contains a working token.
What to do in the first hour
- Revoke the token. Sign in to your Atlassian account, open the security settings, and open the API tokens list. Find the token by its label and revoke it. The label you gave the token when you created it is the quickest way to match it.
- Create a replacement for the tools that still need one. Give it a label that names the tool, and store the value in a secret manager, not in a file.
- Update the integrations that used the old token, and confirm that they still reach Jira and Confluence.
- Review the account’s activity. Look at the recent changes made by the account since the exposure, in Jira and Confluence. Look for tickets created or closed, pages edited or deleted, permission changes and attachments you do not recognize.
- Check the site administration. If you administer the site, review the audit log for the same period and look for new apps, new webhooks and changed project permissions.
- Review the account’s sessions and other tokens. Make sure no other API token or connected app was created by the same person recently.
- Clean the repository. Remove the value and rewrite history if you want to. See I accidentally pushed an API key to GitHub, and use deep-scan your whole git history to find older copies.
Not sure what else leaked? Run a free scan.
Revoke it at Atlassian
Open the API tokens page in your Atlassian account security settings, find the token by its label, and revoke it. Atlassian ends the token as soon as you confirm, and every script that used it will start receiving authentication errors. If you cannot find the token, check whether it was created under a different account, such as a service account or a shared mailbox, because those have their own token lists. Organization administrators can also review tokens across managed accounts from the administration console.
How LeakWatch detects it
The rule is called Atlassian API Token. It looks for the literal, case-sensitive prefix ATATT3, then 50 to 400 characters from letters, digits, underscores, dashes and equals signs, with a word boundary at each end. Atlassian says its token length varies, so the rule does not expect a fixed length. A value where the prefix is written in lower case is not reported by this rule. Older tokens without the prefix are handled by a separate contextual rule. The severity is critical. This type is not checked live: LeakWatch does not call Atlassian with the token it found, so a finding tells you the value has the current format, not whether it still works.
LeakWatch detects this format but does not check it live: it can tell you the key is exposed, not whether it still works. Assume it does until you have revoked it.
FAQ
Does revoking the token affect my Jira or Confluence data?
No. Revoking ends the credential only. Tickets, pages and attachments stay where they are, and the other users are not affected.
My token was only visible for a minute. Do I still need to revoke it?
Yes. Automated scanners watch public repositories continuously, and a token that works for a few minutes can still read a lot of content. Revoking takes a minute, so do it first.
Can I just change the password of the account?
Changing the password does not end an existing API token. Revoke the token itself, and review the account’s other tokens and connected apps while you are there.