MongoDB Atlas App Services
Parent: MongoDB Atlas · Published reference · snapshot 2026-09-08 · skill mongodb-atlas-expert/references/mongodb-atlas-app-services.md
↓ Facts as markdownall context files
> CRITICAL STATUS NOTE (as of May 2026): Atlas App Services reached a split end-of-life on September 30, 2025.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
MongoDB Atlas App Services — Full Platform Reference
- > CRITICAL STATUS NOTE (as of May 2026): Atlas App Services reached a split end-of-life on September 30, 2025. > - STILL LIVE: Database Triggers, Scheduled Triggers, Authentication Triggers, Atlas Functions (invoked by triggers only) > - EOL (shut down September 30, 2025): Atlas Data API, GraphQL API, Custom HTTPS Endpoints, Atlas Device Sync & Device SDKs, static hosting > - Auth providers, Rules/Permissions, and Values/Secrets are only relevant now as context for the still-live Triggers surface [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#mongodb-atlas-app-services-full-platform-reference]
Key Auth Notes
- Email confirmation links expire in 30 minutes [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#key-auth-notes]
- callResetPasswordFunction() is unauthenticated - always return pending for out-of-band verification [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#key-auth-notes]
- Custom JWT: App Services always enforces 30-minute access token expiry regardless of JWT exp claim [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#key-auth-notes]
Rules and Permissions Engine
- Permissions are defined per-collection. Role evaluation: first matching role wins (role order matters). If no role matches, the operation is denied entirely. System functions bypass all rules. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#rules-and-permissions-engine]
- Variables: %%user.id, %%user.custom_data.<field>, %%root.<field>, %%environment.values.<name> [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#rules-and-permissions-engine]
Schema Validation
- App Services schemas are JSON Schema (draft 4 + BSON extensions). Validates every write after the operation is computed but before commit. Key differences from mongod $jsonSchema: App Services validates post-operation; system functions bypass App Services schema. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#schema-validation]
Atlas GraphQL API (DEPRECATED — EOL March 5, 2025)
- Migration: Hasura on MongoDB or Apollo Server + driver. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#atlas-graphql-api-deprecated-eol-march-5-2025]
Atlas Data API (DEPRECATED — EOL September 30, 2025)
- Migration paths: MongoDB driver + Express/FastAPI/Spring Boot, cloud functions (Lambda, Azure, GCR), or Delbridge Data API (open source drop-in). [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#atlas-data-api-deprecated-eol-september-30-2025]
Custom HTTPS Endpoints (DEPRECATED — EOL September 30, 2025)
- Migration: AWS Lambda, Azure Functions, Google Cloud Run, or Vercel serverless functions + MongoDB driver. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#custom-https-endpoints-deprecated-eol-september-30-2025]
Values and Secrets
- Values: Named JSON constants accessed via context.values.get("name") [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#values-and-secrets]
- Secrets: Private strings (max 500 chars) stored encrypted; access indirectly by linking to a Value [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#values-and-secrets]
- Environment Values: context.environment.values.<name> for env-specific config [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#values-and-secrets]
App Services Deployment
- Methods: UI (immediate), CLI (appservices push/pull), GitHub auto-deploy (any push triggers deployment), Admin API. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#app-services-deployment]
- Last 25 deployments stored for rollback [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#app-services-deployment]
- Secrets are NOT included in exported config or git repos - must re-enter manually [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#app-services-deployment]
Billing Model (Still relevant for Triggers)
- Free tier per project: 1M requests/month, 500 compute hours, 10 GB data transfer. Trigger invocations count as requests. [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#billing-model-still-relevant-for-triggers]
Anti-Patterns
- Auto-confirm in production - allows fake email addresses [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#anti-patterns]
- callResetPasswordFunction returning success immediately - unauthenticated callers can reset any user's password [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#anti-patterns]
- Collection-level roles defined but relying on default roles - if any collection-level roles defined, default roles are NOT checked [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#anti-patterns]
- Role order wrong - most specific roles should come first [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#anti-patterns]
- Running App Services schema AND mongod $jsonSchema with validationAction: "error" - can cause confusing double-rejection errors [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#anti-patterns]
References
- Atlas App Services Documentation [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#references]
- Data API and HTTPS Endpoints Deprecation [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#references]
- Atlas Device Sync EOL Forum Post [archived source: https://llms-explorer.com/sources/mdb-context-hub/mongodb-atlas-app-services/#references]
Where this helps
- Supporting an existing production app that still relies on Atlas Database Triggers, Scheduled Triggers, or Authentication Triggers, which remain live post-EOL. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Planning the mandatory migration off Atlas Data API, GraphQL API, or Custom HTTPS Endpoints before their respective EOL dates. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Debugging a permissions bug where a write is unexpectedly denied or allowed, which usually traces back to role evaluation order in the Rules and Permissions engine. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Reasoning about JSON Schema validation differences between App Services and a mongod-level $jsonSchema validator on the same collection. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Project ideas
- Migrate an app off the deprecated Atlas Data API to a small Express/FastAPI service (or a cloud function) that talks to Atlas through a real MongoDB driver. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Build a custom JWT authentication flow for App Services and verify the 30-minute access-token expiry behavior holds regardless of the JWT's own exp claim. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Write a role-ordering test harness for a collection's permissions rules that checks first-matching-role-wins behavior against several user/document combinations. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Set up GitHub auto-deploy for an App Services app and exercise rollback using the last-25-deployments history. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Common mistakes
- Leaving auto-confirm enabled in production, which allows account creation with fake, unverified email addresses. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Returning success immediately from callResetPasswordFunction, which lets an unauthenticated caller learn whether an account exists or effectively trigger resets for any user. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Defining some collection-level roles and assuming default roles still apply elsewhere — once any collection-level role exists, default roles stop being checked entirely. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Running App Services schema validation and mongod's $jsonSchema together with validationAction: "error", which produces confusing double-rejection errors on the same write. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Known issues
- Atlas Data API, GraphQL API, and Custom HTTPS Endpoints are already past their EOL dates (March 5, 2025 and September 30, 2025) and are shut down, not just deprecated — new work should not plan around them. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- Secrets are deliberately excluded from exported config and git repos, so restoring an App Services config from source control requires manually re-entering every secret. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- The custom JWT access-token expiry is fixed at 30 minutes and is enforced regardless of what the token's own exp claim says, which can surprise integrations that assumed the JWT was authoritative. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
- System functions bypass all Rules and Permissions and all schema validation, so any logic that must not be bypassable can't rely on being a "system function" for enforcement. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Children
- App Services Authentication Providers
- App Services Rules and Permissions (frontier)
- App Services Schema Validation
- Atlas GraphQL API (EOL) (frontier)
- Atlas Data API (EOL)
- Custom HTTPS Endpoints (EOL) (frontier)
- App Services Values and Secrets
- App Services Deployment Model (frontier)
- App Services Billing Model
- App Services Migration Paths
Frontier under this node: App Services Deployment Model, App Services Rules and Permissions, Atlas GraphQL API (EOL), Custom HTTPS Endpoints (EOL)