Confluence API access outside VPN - self-hosted Setup

[ConfluenceUser]

Hello everyone, I have a question regarding accessing the Confluence API from outside the company VPN.

Our Confluence application is hosted on an onprem server. When users are connected to the company VPN, they can sign in using both their Microsoft (via SSO) and Confluence accounts. However, if the VPN connection is inactive, users are redirected to the Microsoft SSO page and must log in using their Microsoft account.

For a new use case, we would like to enable API access to our Confluence API from outside the VPN. I've attempted this using the atlassian-python-api library, trying both password-based authentication and OAuth (personal access token). In both cases the API requests are redirected to the Microsoft SSO login page.

Is it possible to implement external API access for a self-hosted Confluence application, bypassing VPN requirements while still supporting authentication?

[ConfluenceUser · Accepted solution]

Hi @Jehan Bhathena Thank you for your response. Our Confluence server is hosted behind an Application Proxy and is accessible only from within the internal company network. The use case involves deploying an data processing application in a cloud environment that needs to connect to the Confluence API to retrieve data.

I resolved this issue by using the Openconnect client along with a dedicated technical Confluence user account. This setup establishes a VPN connection, allowing the application to securely access the Confluence API and fetch the required data.

[Jehan Bhathena]

Hi @ConfluenceUser ,

"Is it possible to implement external API access for a self-hosted Confluence application, bypassing VPN requirements while still supporting authentication?": The simple response to this would be No. Since yours is an on-prem setup, all your network would essentially be filtered and then sent to your Confluence Server, allowing non-VPN access not only opens up routes for harmful external entities but makes your data at risk of being accessed by people not on the authorized network.

It might help if you can share the use case as to why you need to access the API without the VPN, that way we might be able to suggest a workaround? :)