# OAuth2 Token Exchange > Depth-first rabbithole dossier for OAuth2 Token Exchange; source-anchored research pack. Parent: [Atlas Service Accounts](https://llms-explorer.com/tree/atlas-service-accounts/) · 3 facets · 18 facts · page: https://llms-explorer.com/tree/oauth2-token-exchange/ ## How it works - [high] Service Accounts provide programmatic access to the Atlas Admin API using the OAuth 2.0 Client Credentials flow, which is recommended over legacy API keys. Sources: https://www.mongodb.com/docs/atlas/cli/current/command/atlas-api-serviceAccounts.md, https://www.mongodb.com/docs/atlas/api/api-authentication.md, https://veryfront.com/docs/cloud/integrations/mongodb-atlas.md, https://www.mongodb.com/docs/atlas/sdk/go/authentication.md, https://pkg.go.dev/golang.org/x/oauth2 — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/oauth2-token-exchange-f873367fde/rabbithole-synthesis.md#core` - [medium] When a Service account access token is close to expiry, a new token can be generated, and unused tokens should be revoked to minimize security risks. Sources: https://www.mongodb.com/docs/atlas/api/api-authentication.md, https://www.mongodb.com/docs/atlas/configure-api-access.md, https://www.mongodb.com/docs/atlas/sdk/go/authentication.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/oauth2-token-exchange-f873367fde/rabbithole-synthesis.md#core` - [low] In the client credentials flow, a refresh token should not be included, and if issued, it must be kept confidential, transmitted via TLS, and bound to the client identity. Sources: https://www.rfc-editor.org/rfc/rfc6749.txt — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/oauth2-token-exchange-f873367fde/rabbithole-synthesis.md#core` ## Problems, failure modes and limitations - [low] The RetrieveError is returned when the token endpoint returns a non-2XX HTTP status code or populates the RFC 6749 'error' parameter. Sources: https://pkg.go.dev/golang.org/x/oauth2 — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/oauth2-token-exchange-f873367fde/rabbithole-synthesis.md#troubleshooting` - [low] The authorization server must authenticate the client, ignore unrecognized request parameters, and ensure access tokens cannot be guessed or generated by unauthorized parties. Sources: https://www.rfc-editor.org/rfc/rfc6749.txt — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/oauth2-token-exchange-f873367fde/rabbithole-synthesis.md#core` - [low] The atlas-cli-core library reuses unexpired access tokens for Service Accounts to fix token limit errors when running more than 100 commands in an hour. (verified as of 2026-10-15) Sources: https://github.com/mongodb/mongodb-atlas-cli/pull/4656 — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/oauth2-token-exchange-f873367fde/rabbithole-synthesis.md#troubleshooting` ## Facts and statements - [high] Service account access tokens are minted via the OAuth2 client_credentials grant at https://cloud.mongodb.com/api/oauth/token, with credentials sent via HTTP Basic authentication. Sources: https://veryfront.com/docs/cloud/integrations/mongodb-atlas.md, https://pkg.go.dev/golang.org/x/oauth2 — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/oauth2-token-exchange-f873367fde/rabbithole-synthesis.md#core` - [low] The OAuth2 client credentials grant type must only be used by confidential clients, requires TLS for token endpoint requests, and the client must use the HTTP POST method. Sources: https://www.rfc-editor.org/rfc/rfc6749.txt — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/oauth2-token-exchange-f873367fde/rabbithole-synthesis.md#core` - [medium] The Atlas Administration API accepts Service account access tokens (OAuth 2.0) and API keys (HTTP Digest Authentication), but does not provide access to data stored in clusters. Sources: https://www.mongodb.com/docs/atlas/api/api-authentication.md, https://www.mongodb.com/docs/atlas/configure-api-access.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/oauth2-token-exchange-f873367fde/rabbithole-synthesis.md#core` - [high] Service account access tokens have a 1-hour (3600 seconds) lifespan, are not refreshable, and can be reused multiple times during their validity period. Sources: https://www.mongodb.com/docs/atlas/api/api-authentication.md, https://www.mongodb.com/docs/atlas/configure-api-access.md, https://veryfront.com/docs/cloud/integrations/mongodb-atlas.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/oauth2-token-exchange-f873367fde/rabbithole-synthesis.md#core` - [low] Clients can cache Service account access tokens to mitigate rate limiting and adhere to access token limits, with the validity expressed in the `expires_in` field. Sources: https://www.mongodb.com/docs/atlas/sdk/go/authentication.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/oauth2-token-exchange-f873367fde/rabbithole-synthesis.md#core` - [low] Terraform operations generate a new token for the duration of each operation, and an SA Access Token can be provided directly via the MONGODB_ATLAS_ACCESS_TOKEN environment variable. Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/provider-configuration.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/oauth2-token-exchange-f873367fde/rabbithole-synthesis.md#core` - [low] The maximum number of active tokens per MongoDB Atlas service account is 100. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/manual/reference/limits.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/oauth2-token-exchange-f873367fde/rabbithole-synthesis.md#core` - [low] Clients should request access tokens with the minimal scope necessary to adhere to security best practices. Sources: https://www.rfc-editor.org/rfc/rfc6749.txt — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/oauth2-token-exchange-f873367fde/rabbithole-synthesis.md#patterns` - [low] Avoid creating new tokens for every request; instead, reuse the token during its 1-hour lifespan to mitigate rate limiting. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/oauth2-token-exchange-f873367fde/rabbithole-synthesis.md#patterns` - [low] Legacy Atlas programmatic API keys use HTTP Digest auth, which is not supported by the connector; users should use service accounts with OAuth2 client_credentials instead. Sources: https://veryfront.com/docs/cloud/integrations/mongodb-atlas.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/oauth2-token-exchange-f873367fde/rabbithole-synthesis.md#antipatterns` - [high] Service account access tokens can only be used from IPs on the service account's API access list, and the service account must be a member of the organization hosting the project to avoid 401 errors. Sources: https://www.mongodb.com/docs/atlas/api/api-authentication.md, https://veryfront.com/docs/cloud/integrations/mongodb-atlas.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/oauth2-token-exchange-f873367fde/rabbithole-synthesis.md#troubleshooting` - [low] Atlas enforces rate limiting for each combination of IP address and SA client, with the token endpoint limited to 50 requests per minute, returning a 429 status code if exceeded. (verified as of 2026-10-15) Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/provider-configuration.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/oauth2-token-exchange-f873367fde/rabbithole-synthesis.md#troubleshooting` ## Related concepts - Token — is a part of OAuth2 Token Exchange - OAuth2 — is a part of OAuth2 Token Exchange