MongoDB Atlas App Services

MongoDB Atlas App Services — Full Platform Reference

CRITICAL STATUS NOTE (as of May 2026): Atlas App Services reached a split end-of-life on September 30, 2025.

• STILL LIVE: Database Triggers, Scheduled Triggers, Authentication Triggers, Atlas Functions (invoked by triggers only)
• EOL (shut down September 30, 2025): Atlas Data API, GraphQL API, Custom HTTPS Endpoints, Atlas Device Sync & Device SDKs, static hosting
• Auth providers, Rules/Permissions, and Values/Secrets are only relevant now as context for the still-live Triggers surface

Authentication Providers

Key Auth Notes

• Email confirmation links expire in 30 minutes
• callResetPasswordFunction() is unauthenticated — always return pending for out-of-band verification
• Custom JWT: App Services always enforces 30-minute access token expiry regardless of JWT exp claim

Rules and Permissions Engine

Permissions are defined per-collection. Role evaluation: first matching role wins (role order matters). If no role matches, the operation is denied entirely. System functions bypass all rules.

Variables: %%user.id, %%user.custom_data.<field>, %%root.<field>, %%environment.values.<name>

Schema Validation

App Services schemas are JSON Schema (draft 4 + BSON extensions). Validates every write after the operation is computed but before commit. Key differences from mongod $jsonSchema: App Services validates post-operation; system functions bypass App Services schema.

Atlas GraphQL API (DEPRECATED — EOL March 5, 2025)

Migration: Hasura on MongoDB or Apollo Server + driver.

Atlas Data API (DEPRECATED — EOL September 30, 2025)

Migration paths: MongoDB driver + Express/FastAPI/Spring Boot, cloud functions (Lambda, Azure, GCR), or Delbridge Data API (open source drop-in).

Custom HTTPS Endpoints (DEPRECATED — EOL September 30, 2025)

Migration: AWS Lambda, Azure Functions, Google Cloud Run, or Vercel serverless functions + MongoDB driver.

Values and Secrets

• Values: Named JSON constants accessed via context.values.get("name")
• Secrets: Private strings (max 500 chars) stored encrypted; access indirectly by linking to a Value
• Environment Values: context.environment.values.<name> for env-specific config

App Services Deployment

Methods: UI (immediate), CLI (appservices push/pull), GitHub auto-deploy (any push triggers deployment), Admin API.

• Last 25 deployments stored for rollback
• Secrets are NOT included in exported config or git repos — must re-enter manually

Billing Model (Still relevant for Triggers)

Free tier per project: 1M requests/month, 500 compute hours, 10 GB data transfer. Trigger invocations count as requests.

Migration Reference (Post-EOL)

Anti-Patterns

• Auto-confirm in production — allows fake email addresses
• callResetPasswordFunction returning success immediately — unauthenticated callers can reset any user’s password
• Collection-level roles defined but relying on default roles — if any collection-level roles defined, default roles are NOT checked
• Role order wrong — most specific roles should come first
• Running App Services schema AND mongod $jsonSchema with validationAction: "error" — can cause confusing double-rejection errors

References

1. Atlas App Services Documentation
2. Data API and HTTPS Endpoints Deprecation
3. Atlas Device Sync EOL Forum Post