Atlas Programmatic API Keys (Legacy)
Parent: MongoDB Atlas IAM and RBAC · Published reference · snapshot 2026-10-23 · skill mongodb-cohort-3e9502b80e34
↓ Facts as markdownall context files
Source-anchored research for Atlas Programmatic API Keys (Legacy). Run status: COMPLETED.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
Structure and components
- An API key consists of a Public Key and Private Key used for HTTP Digest authentication. MongoDB’s curl example uses --user with the pair and --digest. (high confidence) [source]
How it works
- The organization IP-access-list requirement is conditional: UI-created organizations require it by default, but disabling the requirement permits Internet requests when the list is empty. A populated list restricts originating addresses. Missing entries under the requirement can cause HTTP 403. (low confidence) (verified as of 2026-10-14) [source]
- HashiCorp’s Atlas secrets engine generates a Programmatic API Key per Vault lease and automatically revokes it when the lease expires unless renewed. This expiry is managed by Vault; it is not evidence that ordinary Atlas API keys have the same built-in TTL. (low confidence) (verified as of 2026-10-23) [source]
- Vault’s MongoDB Atlas secrets engine creates programmatic API keys per lease with organization or project roles and optional IP restrictions. Vault revokes these credentials when their leases expire unless renewed; this is Vault-managed lifetime behavior. (low confidence) (verified as of 2026-10-23) [source]
Problems, failure modes and limitations
- A 2021 Terraform provider 0.7.0 issue records a final Unauthorized error during import even though curl with the same key succeeded after an initial HTTP 401 Digest challenge and subsequent HTTP 200. Inspect the completed authentication exchange before treating every 401 line as proof of unusable credentials. This is historical evidence, not a verified current provider defect. (medium confidence) [source]
Comparisons and alternatives
- The Atlas creation workflow displays the private key only once and instructs users to save it securely. Microsoft stores discovery secrets in VS Code Secret Storage and warns against placing credentials in source control. (high confidence) [source]
Facts and statements
- MongoDB documents API keys as a supported legacy Atlas Administration API authentication method and recommends service accounts instead; legacy status alone does not establish a removal date. (high confidence) (verified as of 2026-10-14) [source]
- API keys authorize Atlas management operations, not direct reads or writes of cluster data. Database connections require separate database-user credentials; Microsoft documents the same separation for Atlas resource discovery. (high confidence) [source]
- Each API-key pair belongs to one organization and may receive access to multiple projects within it. Microsoft requires another discovery credential for another organization. (high confidence) (verified as of 2026-10-14) [source]
- Assigned organization and project roles constrain what a key can do. HashiCorp’s Atlas secrets engine likewise issues keys with designated roles and can configure their allowed IP addresses or CIDR ranges. (high confidence) [source]
- MongoDB displays the Private Key only once during creation, so automation owners must securely save it at that point. (low confidence) [source]
- HashiCorp maintains a separate Atlas secrets-engine plugin for generating ephemeral Programmatic API Keys; this provides a concrete implementation lead for key lifecycle automation. (medium confidence) (verified as of 2026-10-23) [source]
- For this cost-driver investigation, the reviewed API authentication and setup documentation establishes credential, organization, role, and IP-list requirements, but does not establish an M10 minimum or per-key surcharge. This is a scoped evidence finding; it does not show that every API operation is available on every cluster tier. (low confidence) (verified as of 2026-10-14) [source]
- MongoDB labels API keys legacy and recommends service accounts; current Terraform documentation still supports programmatic keys alongside its recommended service-account method. Legacy does not establish that keys have been removed. (high confidence) (verified as of 2026-10-23) [source]
- Each API-key pair belongs to one organization. Project visibility and permitted operations depend on assigned access and roles; Microsoft instructs users to configure credentials for each organization they need to browse. (high confidence) [source]
- Vault’s Atlas API-key secrets engine and its Atlas database plugin issue different credentials: the former generates programmatic API keys, while the latter generates ephemeral database-user credentials and uses Atlas API keys for its management integration. (high confidence) [source]
- The Atlas Terraform provider accepts public_key/private_key credentials, including MONGODB_ATLAS_PUBLIC_API_KEY and MONGODB_ATLAS_PRIVATE_API_KEY environment variables. Its migration guidance replaces these with service-account credentials and validates the change with terraform plan. (low confidence) (verified as of 2026-10-23) [source]
- The reviewed sources do not establish an M10-or-higher prerequisite for programmatic keys. HashiCorp’s Atlas database-plugin acceptance-test instructions explicitly allow a free-tier cluster and require Atlas public/private API keys. This scopes the evidence to that workflow, not every Administration API operation. (medium confidence) (verified as of 2026-10-23) [source]
Children
- No children recorded.