# Service Account Roles > Depth-first rabbithole dossier for Service Account Roles; source-anchored research pack. Parent: [Atlas Service Accounts](https://llms-explorer.com/tree/atlas-service-accounts/) · 3 facets · 22 facts · page: https://llms-explorer.com/tree/service-account-roles/ ## Problems, failure modes and limitations - [low] Atlas roles limit which operations a service account can authenticate with its access token. Sources: https://www.mongodb.com/docs/atlas/api/api-authentication.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/service-account-roles-63d0eda6f4/rabbithole-synthesis.md#core` - [low] You can't use a service account or its access token to log into Atlas through the Atlas UI. Sources: https://www.mongodb.com/docs/atlas/api/api-authentication.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/service-account-roles-63d0eda6f4/rabbithole-synthesis.md#core` - [low] The limit for Atlas service accounts per MongoDB Atlas organization is 200. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/manual/reference/limits.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/service-account-roles-63d0eda6f4/rabbithole-synthesis.md#core` - [low] The limit for access list entries per MongoDB Atlas service account is 200. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/manual/reference/limits.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/service-account-roles-63d0eda6f4/rabbithole-synthesis.md#core` ## Comparisons and alternatives - [low] MongoDB recommends using service accounts instead of API keys to authenticate to the Atlas Administration API because API keys are a legacy authentication method. Sources: https://www.mongodb.com/docs/atlas/api/api-authentication.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/service-account-roles-63d0eda6f4/rabbithole-synthesis.md#core` ## Facts and statements - [high] The Service Account object includes a list of organization-level roles and a human-readable name that is modifiable and does not have to be unique. Sources: https://www.pulumi.com/registry/packages/mongodbatlas/api-docs/serviceaccount/, https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/resources/service_account.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/service-account-roles-63d0eda6f4/rabbithole-synthesis.md#core` - [low] If a project-level service account has access to the organization or other projects, you must have the Organization Owner role to manage its lifecycle. Sources: https://www.mongodb.com/docs/atlas/api/api-authentication.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/service-account-roles-63d0eda6f4/rabbithole-synthesis.md#core` - [medium] Service accounts only grant access to the Atlas Administration API, which does not include UI access or access to cluster data. Sources: https://www.mongodb.com/docs/atlas/api/api-authentication.md, https://www.mongodb.com/docs/atlas/configure-api-access.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/service-account-roles-63d0eda6f4/rabbithole-synthesis.md#core` - [low] Each service account belongs to exactly one organization, and you can grant it access to any number of projects within that organization. Sources: https://www.mongodb.com/docs/atlas/api/api-authentication.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/service-account-roles-63d0eda6f4/rabbithole-synthesis.md#core` - [low] The Atlas Administration API accepts service account access tokens (OAuth 2.0) and API keys (HTTP Digest Authentication) as authentication methods. Sources: https://www.mongodb.com/docs/atlas/api/api-authentication.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/service-account-roles-63d0eda6f4/rabbithole-synthesis.md#core` - [low] To create a service account or API keys for an organization, you must have Organization Owner access to that organization. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/service-account-roles-63d0eda6f4/rabbithole-synthesis.md#core` - [low] To grant a service account access to a project, you must have Organization Owner access to the organization that owns the project. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/service-account-roles-63d0eda6f4/rabbithole-synthesis.md#core` - [low] If you assign an organization service account to a project, the Project Owner can manage the service account, including rotating secrets and updating the IP access list. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/service-account-roles-63d0eda6f4/rabbithole-synthesis.md#core` - [low] IP access lists apply only to programmatic API keys and service accounts, not to other access types like the Atlas CLI or delegated access through Atlas App Connections. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/service-account-roles-63d0eda6f4/rabbithole-synthesis.md#core` - [low] You should create a service account with at least Organization Read Only or Project Read Only on specific projects. Sources: https://veryfront.com/docs/cloud/integrations/mongodb-atlas.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/service-account-roles-63d0eda6f4/rabbithole-synthesis.md#core` - [low] You can create and update service accounts within the project. Sources: https://www.mongodb.com/docs/atlas/reference/user-roles.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/service-account-roles-63d0eda6f4/rabbithole-synthesis.md#core` - [low] Users with a specific role can edit their own role or create an API key or service account to raise their privileges to Project Owner. Sources: https://www.mongodb.com/docs/atlas/reference/user-roles.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/service-account-roles-63d0eda6f4/rabbithole-synthesis.md#antipatterns` - [low] For resources where the service account or API keys used to authenticate are not members of the hosting organization, Atlas responds with a 401 status code. Sources: https://www.mongodb.com/docs/atlas/api/api-authentication.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/service-account-roles-63d0eda6f4/rabbithole-synthesis.md#troubleshooting` - [low] Service account access tokens can only be used from IPs on the service account's API access list. Sources: https://veryfront.com/docs/cloud/integrations/mongodb-atlas.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/service-account-roles-63d0eda6f4/rabbithole-synthesis.md#troubleshooting` - [low] If your key has both the Organization Owner and Project Owner roles, it has full access. Sources: https://www.mongodb.com/docs/atlas/reference/user-roles.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/service-account-roles-63d0eda6f4/rabbithole-synthesis.md#core` - [low] An example configuration sets roles to ["ORG_MEMBER"]. Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/migrate-pak-to-service-account.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/service-account-roles-63d0eda6f4/rabbithole-synthesis.md#tools` - [low] An example configuration sets roles to ["GROUP_READ_ONLY", "GROUP_DATA_ACCESS_READ_ONLY"]. Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/migrate-pak-to-service-account.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/service-account-roles-63d0eda6f4/rabbithole-synthesis.md#tools` ## Related concepts - Service — is a part of Service Account Roles - Account — is a part of Service Account Roles - Roles — is a part of Service Account Roles