# Cloud Build Atlas API Auth > Source-anchored research for Cloud Build Atlas API Auth. Run status: COMPLETED. Parent: [MongoDB Atlas on GCP](https://llms-explorer.com/tree/mongodb-atlas-on-gcp/) · 5 facets · 15 facts · page: https://llms-explorer.com/tree/cloud-build-atlas-api-auth/ ## Structure and components - Integration pattern inferred from the component documentation: store Atlas credentials in Google Secret Manager, authorize the Cloud Build execution service account to retrieve that secret, and use the retrieved credentials for a separate Atlas token exchange. Google IAM secret access does not itself assign Atlas administrative roles. (medium confidence) (verified as of 2026-10-20) — [source](https://docs.cloud.google.com/build/docs/securing-builds/use-secrets) ## How it works - Granting secret access to the legacy Cloud Build service account can expose that capability to users who can execute its build triggers, even when those users lack Secret Accessor themselves. Review trigger execution permissions when storing Atlas administrative credentials. (low confidence) (verified as of 2026-10-20) — [source](https://docs.cloud.google.com/build/docs/securing-builds/use-secrets) - When Atlas requires an Administration API IP access list, a request without an allowed entry receives 403. Token generation is exempt from that list, but subsequent API calls using the token are subject to it. Successful token issuance therefore does not prove the build can call the API. (low confidence) (verified as of 2026-10-23) — [source](https://www.mongodb.com/docs/atlas/configure-api-access/) ## Problems, failure modes and limitations - Atlas service accounts use the OAuth 2.0 Client Credentials flow. Tokens last 3600 seconds, can be reused, and cannot be refreshed; generate another token near expiry. (high confidence) (verified as of 2026-10-23) — [source](https://www.mongodb.com/docs/atlas/api/api-authentication/) ## Comparisons and alternatives - When an Atlas API access list is required, allow the calling build host's public egress address. Obtaining a token does not prove its use is allowed: Atlas applies the list to API calls rather than token creation or revocation. Percona independently reports ORG_REQUIRES_ACCESS_LIST when its API-key workflow lacks an entry. (high confidence) (verified as of 2026-10-23) — [source](https://www.mongodb.com/docs/atlas/configure-api-access/) - Google workload-identity support listed for Cloud Build concerns driver connections to Atlas clusters. It must not be treated as evidence that a Google-issued token authenticates to the Atlas Administration API, whose service accounts and API keys grant administrative access rather than database-data access. (high confidence) (verified as of 2026-10-23) — [source](https://www.mongodb.com/docs/atlas/workload-oidc/) ## Facts and statements - Atlas recommends service-account OAuth 2.0 Client Credentials for administrative automation; public/private API keys remain supported through legacy HTTP Digest authentication. (high confidence) (verified as of 2026-10-23) — [source](https://www.mongodb.com/docs/atlas/api/api-authentication/) - Request a service-account token by POSTing grant_type=client_credentials to https://cloud.mongodb.com/api/oauth/token with Basic authentication containing the Atlas client ID and secret; use the returned token as Bearer authentication for API calls. (high confidence) — [source](https://www.mongodb.com/docs/atlas/configure-api-access/) - For Cloud Build shell arguments, Google documents availableSecrets.secretManager mappings, per-step secretEnv, a bash entrypoint with -c, and $$-prefixed environment-variable references. Grant roles/secretmanager.secretAccessor on the secret to the account executing the build. (low confidence) (verified as of 2026-10-20) — [source](https://docs.cloud.google.com/build/docs/securing-builds/use-secrets) - Legacy API-key calls need Digest-capable HTTP clients using the public key as username and private key as password. A firsthand Node.js report of 401 errors documents sendImmediately:false in the request library; this is a historical client-specific fix, not a setting for every HTTP client. (high confidence) — [source](https://www.mongodb.com/docs/atlas/api/api-authentication/) - A user of Elastic's MongoDB Atlas integration version 1.2.0 reported on April 28, 2026 that its configuration exposed only public/private API-key fields and requested OAuth service-account support. This is evidence to check a chosen connector's authentication capabilities before migrating credentials; it does not establish the connector's current support state. (low confidence) (verified as of 2026-04-28) — [source](https://github.com/elastic/integrations/issues/18676) - Administration API credentials manage Atlas resources and database users but do not grant access to stored cluster data; database connections require separate database authentication. (high confidence) — [source](https://www.mongodb.com/docs/atlas/api/api-authentication/) - Cloud Build maps Secret Manager versions through availableSecrets.secretManager and exposes selected variables through each step’s secretEnv. In bash command arguments, use $$VARIABLE so Cloud Build passes the variable reference to the shell. (low confidence) (verified as of 2026-10-20) — [source](https://docs.cloud.google.com/build/docs/securing-builds/use-secrets) - Atlas Administration API is reachable through the public Internet, not Atlas network peering or private endpoints. Builds must have a usable public egress path for administration calls. (low confidence) (verified as of 2026-10-23) — [source](https://www.mongodb.com/docs/atlas/configure-api-access/) - A 2020 firsthand Fetch report describes a Digest challenge followed by continued 401 responses from a manually built Authorization header; a 2021 answer reports success with digest-fetch. This is historical troubleshooting evidence, not a current compatibility guarantee. (low confidence) — [source](https://stackoverflow.com/questions/61992647/digest-authorizarion-with-fetch-and-mongodb-atlas/67005569)