Atlas CLI Integration

Parent: Atlas Service Accounts · Published reference · snapshot 2026-10-15

Depth-first rabbithole dossier for Atlas CLI Integration; source-anchored research pack.

These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.

Definitions

[low] The `MONGODB_ATLAS_ACCESS_TOKEN` environment variable is a string that grants access to your Atlas account and is valid for 12 hours. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/atlas/cli/current/atlas-cli-env-variables.md [source]
[low] The Atlas Organization ID is a 24-character hexadecimal value found in your Atlas Organization Settings. Sources: https://docs.aws.amazon.com/secretsmanager/latest/userguide/mes-partner-MongoDBAtlasServiceAccount.html [source]

Structure and components

[low] API keys consist of a Public Key and a Private Key, which Atlas hashes using a unique value called a nonce that is valid for a short amount of time per the HTTP Digest Authentication specification. Sources: https://www.mongodb.com/docs/atlas/api/api-authentication.md [source]

How it works

[low] When running a command with the `--projectId` option, the command line option takes precedence over both the environment variable and the profile stored in the configuration file. Sources: https://www.mongodb.com/docs/atlas/cli/current/atlas-cli-env-variables.md [source]
[low] The `MONGODB_ATLAS_REFRESH_TOKEN` environment variable is a string that allows Atlas to automatically request a new access token when the current access token expires. Sources: https://www.mongodb.com/docs/atlas/cli/current/atlas-cli-env-variables.md [source]
[low] Atlas CLI makes `atlas config init` an alias of `atlas auth login` and introduces a new flow to `atlas auth login` to provide the option to set up an API key profile. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/atlas/cli/current/atlas-cli-changelog.md [source]
[low] Atlas CLI changes browser behavior so it does not automatically open when logging in with a user account. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/atlas/cli/current/atlas-cli-changelog.md [source]
[low] Atlas CLI fixes a bug where telemetry tracking events were not propagated when a default profile was not set. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/atlas/cli/current/atlas-cli-changelog.md [source]

Problems, failure modes and limitations

[low] You cannot edit the API access list for a project API key using the Atlas CLI. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md [source]
[low] Some migrated profiles might cause Atlas CLI commands to fail when authenticating with `atlas auth login`. Sources: https://www.mongodb.com/docs/atlas/cli/current/connect-atlas-cli.md [source]
[low] An error message stating "Global user is from outside access listed subnets" may appear when fetching organizations. Sources: https://www.mongodb.com/docs/atlas/cli/current/connect-atlas-cli.md [source]
[low] You cannot use API keys to log into Atlas through the Atlas UI. Sources: https://www.mongodb.com/docs/atlas/api/api-authentication.md [source]
[low] You cannot use the API key for a project until you set up the API access list. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md [source]
[low] Environment variables silently override credentials entered during `atlas auth login`, which can surface later as an opaque `oauth2: "invalid_client"` error. Sources: https://github.com/mongodb/mongodb-atlas-cli/pull/4830 [source]

Comparisons and alternatives

[low] MongoDB recommends using service accounts instead of API keys to authenticate to the Atlas Administration API, as API keys are a legacy authentication method. Sources: https://www.mongodb.com/docs/atlas/api/api-authentication.md [source]
[low] Postman may automatically retry HTTP requests with HTTPS but strip the header and body, returning a 401 status code instead of 301, which makes it difficult to determine why the request failed. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md [source]

Facts and statements

[low] The `UserAccount` option requires manual login and verification of an authentication token that is valid for 12 hours. Sources: https://www.mongodb.com/docs/atlas/cli/current/connect-atlas-cli.md [source]
[low] The login command opens a browser window and returns a one-time activation code that expires after 10 minutes. Sources: https://www.mongodb.com/docs/atlas/cli/current/connect-atlas-cli.md [source]
[low] You can use either MongoDB CLI environment variables or Atlas CLI environment variables, but not both together. Sources: https://www.mongodb.com/docs/atlas/cli/current/atlas-cli-env-variables.md [source]
[low] The `MONGODB_ATLAS_CLIENT_ID` environment variable sets the Service Account client ID for commands that interact with Atlas. Sources: https://www.mongodb.com/docs/atlas/cli/current/atlas-cli-env-variables.md [source]
[low] The `MONGODB_ATLAS_CLIENT_SECRET` environment variable sets the Service Account client secret for commands that interact with Atlas. Sources: https://www.mongodb.com/docs/atlas/cli/current/atlas-cli-env-variables.md [source]
[low] Atlas CLI adds support for service accounts as an authentication method and enables login and logout with service account profiles. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/atlas/cli/current/atlas-cli-changelog.md [source]
[low] Atlas CLI adds a tutorial on how to authenticate an Atlas CLI profile using service accounts. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/atlas/cli/current/atlas-cli-changelog.md [source]
[low] Atlas CLI adds a plugin version verification for `atlas-cli-plugin-kubernetes` to ensure that a version of the plugin compatible with secure credential storage is used. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/atlas/cli/current/atlas-cli-changelog.md [source]
[low] Atlas CLI updates the `atlas config describe` command to no longer redact public API keys. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/atlas/cli/current/atlas-cli-changelog.md [source]
[low] Atlas CLI improves onboarding for users with more than 500 organizations. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/atlas/cli/current/atlas-cli-changelog.md [source]
[low] IP access lists apply only to programmatic API keys and service accounts, not to other types of access to the Atlas Administration API such as the Atlas CLI or delegated access granted through Atlas App Connections. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md [source]
[low] Atlas CLI versions before 1.47 store API keys in plaintext in the configuration file, whereas Atlas CLI 1.47 and later attempt to store credentials securely. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/atlas/cli/current/connect-atlas-cli.md [source]
[low] Atlas CLI resolved an issue affecting authentication via environment variables. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/atlas/cli/current/atlas-cli-changelog.md [source]
[low] Atlas CLI fixes an issue where the `atlas auth login` command fails to prompt for the default organization. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/atlas/cli/current/atlas-cli-changelog.md [source]
[low] Atlas CLI improves the validation of invalid profile names. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/atlas/cli/current/atlas-cli-changelog.md [source]
[low] Atlas CLI fixes a bug where it was not possible to filter organizations or projects by name during onboarding. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/atlas/cli/current/atlas-cli-changelog.md [source]
[low] Tools default to the `application/vnd.atlas.2025-03-12+json` resource version, and Atlas returns a 406 status code if the header is missing or names a nonexistent version. (verified as of 2026-10-15) Sources: https://veryfront.com/docs/cloud/integrations/mongodb-atlas.md [source]
[low] Viper treats empty environment variable values as unset and falls back to the configuration file, following the CLI's general environment variable behavior. Sources: https://github.com/mongodb/mongodb-atlas-cli/pull/4830 [source]
[low] The Atlas Administration API accepts service account access tokens (OAuth 2.0) and API keys (HTTP Digest Authentication) as authentication methods. Sources: https://www.mongodb.com/docs/atlas/api/api-authentication.md [source]
[medium] The Atlas Administration API does not provide access to the data stored in your clusters. Sources: https://www.mongodb.com/docs/atlas/api/api-authentication.md, https://www.mongodb.com/docs/atlas/configure-api-access.md [source]
[low] Each pair of API keys belongs to only one organization and can grant access to any number of projects in that organization. Sources: https://www.mongodb.com/docs/atlas/api/api-authentication.md [source]
[low] Delegated access settings for partner applications and MCP clients are off by default in existing organizations. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md [source]
[low] The Atlas Admin API version date is in `yyyy-mm-dd` format, used in the `Accept` header as `application/vnd.atlas.{apiVersion}+json`, and defaults to `2025-03-12` if not specified. (verified as of 2026-10-15) Sources: https://docs.aws.amazon.com/secretsmanager/latest/userguide/mes-partner-MongoDBAtlasServiceAccount.html [source]
[low] To configure service account authentication in tools, add `MONGODB_ATLAS_CLIENT_ID` and `MONGODB_ATLAS_CLIENT_SECRET` to your `.env` file. Sources: https://veryfront.com/docs/cloud/integrations/mongodb-atlas.md [source]
[low] In Go code, the service account client ID and secret are retrieved using `os.Getenv("MONGODB_ATLAS_CLIENT_ID")` and `os.Getenv("MONGODB_ATLAS_CLIENT_SECRET")` respectively. Sources: https://www.mongodb.com/docs/atlas/sdk/go/authentication.md [source]
[low] For resources hosted in a project, the service account or API keys used to authenticate the request must be a member of the organization hosting the project; otherwise, Atlas responds with a 401 status code. Sources: https://www.mongodb.com/docs/atlas/api/api-authentication.md [source]
[low] If you make a request to the Atlas Administration API without an IP access list entry, the server responds with a 403 status code. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md [source]
[low] Using HTTP URLs for the Atlas Administration API will return a 301 status code. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md [source]
[low] Service account access tokens can only be used from IPs on the service account's API access list. Sources: https://veryfront.com/docs/cloud/integrations/mongodb-atlas.md [source]

Related concepts

Atlas — is a part of Atlas CLI Integration
CLI — is a part of Atlas CLI Integration
Integration — is a part of Atlas CLI Integration

Children

No children recorded.

← the whole tree · 3D view· how to read this page