Atlas IP access list for service accounts

Parent: Atlas Identity Federation and Resource Policy Boundaries · Published reference · snapshot 2026-10-15

Depth-first rabbithole dossier for Atlas IP access list for service accounts; source-anchored research pack.

These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.

Problems, failure modes and limitations

[low] You can't use the API key for a project until you set up the API access list. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md [source]
[low] You can't edit the API access list for a project API key using the Atlas CLI. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md [source]

Comparisons and alternatives

[low] Using an HTTP URL with Postman returns a 301 status code, but Postman may automatically retry the request with HTTPS while stripping the header and body, resulting in a 401 status code instead of 301. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md [source]

Facts and statements

[low] IP access lists apply only to programmatic API keys and service accounts, not to other access types such as the Atlas CLI or delegated access granted through Atlas App Connections. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md [source]
[low] To configure an IP access list for a service account, you enter an IP address or CIDR block from which you want Atlas to accept API requests for that service account. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md [source]
[low] You can generate a service account access token from any IP address, but you can only use it to call the Atlas Administration API if your IP address is on the access list. Sources: https://www.mongodb.com/docs/atlas/api/service-accounts/generate-oauth2-token.md [source]
[low] To create a service account or API keys for an organization, you must have Organization Owner access to that organization. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md [source]
[low] If you assign an organization service account to a project, the Project Owner can manage the service account, including rotating secrets and updating the IP access list. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md [source]
[low] MongoDB Atlas allows up to 200 access list entries per service account and 200 access list entries per project. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/manual/reference/limits.md [source]
[low] The Terraform provider for MongoDB Atlas includes new resources `resource/service_account_access_list_entry` and `resource/project_service_account_access_list_entry` for managing IP access lists. Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/CHANGELOG.md [source]
[low] The Terraform provider for MongoDB Atlas includes new data sources `data-source/service_account_access_list_entries` and `data-source/project_service_account_access_list_entries` for retrieving IP access lists. Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/CHANGELOG.md [source]
[high] The service account access token is obtained via POST to https://cloud.mongodb.com/api/oauth/token using OAuth2 client_credentials authentication. Sources: https://www.mongodb.com/docs/atlas/api/service-accounts/generate-oauth2-token.md, https://raw.githubusercontent.com/ansible-collections/community.mongodb/master/plugins/modules/mongodb_atlas_oidc_user.py [source]
[low] The service account access token has a validity duration of 3600 seconds, indicated by the "expires_in":3600 field. Sources: https://www.mongodb.com/docs/atlas/api/service-accounts/generate-oauth2-token.md [source]
[low] If you make a request to the Atlas Administration API without an IP access list entry, the server responds with a 403 status code. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md [source]
[low] Delegated access settings for partner applications and MCP clients are off by default in existing organizations. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md [source]
[low] To grant API keys access to a project, you must have Project Owner access for that project. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md [source]
[low] MongoDB Atlas allows up to 200 service accounts per organization. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/manual/reference/limits.md [source]
[low] MongoDB Atlas allows up to 100 active tokens per service account. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/manual/reference/limits.md [source]
[low] MongoDB uses HTTPS URLs to increase security; using HTTP URLs will return a 301 status code. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md [source]
[low] MongoDB Atlas allows up to 500 API keys per organization. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/manual/reference/limits.md [source]
[low] The C#/.NET driver supports OIDC authentication from version 2.25 onwards. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/atlas/workload-oidc.md [source]
[low] PyMongo supports enterprise authentication from version 4.7 onwards. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/atlas/workload-oidc.md [source]

Related concepts

Atlas — is a part of Atlas IP access list for service accounts
access — is a part of Atlas IP access list for service accounts
list — is a part of Atlas IP access list for service accounts
service — is a part of Atlas IP access list for service accounts
for — is a part of Atlas IP access list for service accounts
accounts — is a part of Atlas IP access list for service accounts

Children

No children recorded.

← the whole tree · 3D view· how to read this page