Confluence Rovo MCP Server returns "invalid_token" error during integration
Platform Notice: Cloud Only - This article only applies to Atlassian apps on the cloud platform.
Summary
When integrating external clients (such as AWS DevOps Agent) with the Atlassian Rovo MCP server, the connection fails with an invalid_token error. This typically occurs when using API token authentication if the credentials are not correctly formatted or base64-encoded.
Diagnosis
Environment
Atlassian Rovo MCP Server
External clients (e.g., AWS DevOps Agent, custom MCP clients)
Authentication via Atlassian API Tokens
Users encounter the following error response when attempting to connect to the MCP server endpoint (https://mcp.atlassian.com/v1/mcp/authv2):
{ "error": "invalid_token", "error_description": "Missing or invalid access token"}
Cause
The MCP server rejects the connection because the Authorization header is either missing, malformed, or the base64-encoded string does not follow the required user@domain.com:API_TOKEN pattern.
Solution
1. Verify API Token Scopes
Ensure the API token is created with the necessary scopes for Rovo MCP. You can use the following link to generate a token with the correct pre-selected scopes:
2. Correct Base64 Encoding
The credentials must be encoded in the format emailaddress:API_TOKEN. When encoding via terminal, ensure you use the -n flag to avoid trailing newlines, which can invalidate the token.
Run the following command:
echo -n "your-email@example.com:YOUR_API_TOKEN" | base64
3. Update Authorization Header
Ensure the resulting base64 string is passed in the request header as follows:
Authorization: Basic <base64_encoded_string>
4. Re-register the MCP
After updating the credentials, re-initiate the registration or connection process in your client to ensure the new token is propagated.
Related Documentation:
Was this helpful?