OAuth2 Token Exchange

Parent: Atlas Service Accounts · Published reference · snapshot 2026-10-15

Depth-first rabbithole dossier for OAuth2 Token Exchange; source-anchored research pack.

These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.

How it works

[high] Service Accounts provide programmatic access to the Atlas Admin API using the OAuth 2.0 Client Credentials flow, which is recommended over legacy API keys. Sources: https://www.mongodb.com/docs/atlas/cli/current/command/atlas-api-serviceAccounts.md, https://www.mongodb.com/docs/atlas/api/api-authentication.md, https://veryfront.com/docs/cloud/integrations/mongodb-atlas.md, https://www.mongodb.com/docs/atlas/sdk/go/authentication.md, https://pkg.go.dev/golang.org/x/oauth2 [source]
[medium] When a Service account access token is close to expiry, a new token can be generated, and unused tokens should be revoked to minimize security risks. Sources: https://www.mongodb.com/docs/atlas/api/api-authentication.md, https://www.mongodb.com/docs/atlas/configure-api-access.md, https://www.mongodb.com/docs/atlas/sdk/go/authentication.md [source]
[low] In the client credentials flow, a refresh token should not be included, and if issued, it must be kept confidential, transmitted via TLS, and bound to the client identity. Sources: https://www.rfc-editor.org/rfc/rfc6749.txt [source]

Problems, failure modes and limitations

[low] The RetrieveError is returned when the token endpoint returns a non-2XX HTTP status code or populates the RFC 6749 'error' parameter. Sources: https://pkg.go.dev/golang.org/x/oauth2 [source]
[low] The authorization server must authenticate the client, ignore unrecognized request parameters, and ensure access tokens cannot be guessed or generated by unauthorized parties. Sources: https://www.rfc-editor.org/rfc/rfc6749.txt [source]
[low] The atlas-cli-core library reuses unexpired access tokens for Service Accounts to fix token limit errors when running more than 100 commands in an hour. (verified as of 2026-10-15) Sources: https://github.com/mongodb/mongodb-atlas-cli/pull/4656 [source]

Facts and statements

[high] Service account access tokens are minted via the OAuth2 client_credentials grant at https://cloud.mongodb.com/api/oauth/token, with credentials sent via HTTP Basic authentication. Sources: https://veryfront.com/docs/cloud/integrations/mongodb-atlas.md, https://pkg.go.dev/golang.org/x/oauth2 [source]
[low] The OAuth2 client credentials grant type must only be used by confidential clients, requires TLS for token endpoint requests, and the client must use the HTTP POST method. Sources: https://www.rfc-editor.org/rfc/rfc6749.txt [source]
[medium] The Atlas Administration API accepts Service account access tokens (OAuth 2.0) and API keys (HTTP Digest Authentication), but does not provide access to data stored in clusters. Sources: https://www.mongodb.com/docs/atlas/api/api-authentication.md, https://www.mongodb.com/docs/atlas/configure-api-access.md [source]
[high] Service account access tokens have a 1-hour (3600 seconds) lifespan, are not refreshable, and can be reused multiple times during their validity period. Sources: https://www.mongodb.com/docs/atlas/api/api-authentication.md, https://www.mongodb.com/docs/atlas/configure-api-access.md, https://veryfront.com/docs/cloud/integrations/mongodb-atlas.md [source]
[low] Clients can cache Service account access tokens to mitigate rate limiting and adhere to access token limits, with the validity expressed in the `expires_in` field. Sources: https://www.mongodb.com/docs/atlas/sdk/go/authentication.md [source]
[low] Terraform operations generate a new token for the duration of each operation, and an SA Access Token can be provided directly via the MONGODB_ATLAS_ACCESS_TOKEN environment variable. Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/provider-configuration.md [source]
[low] The maximum number of active tokens per MongoDB Atlas service account is 100. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/manual/reference/limits.md [source]
[low] Clients should request access tokens with the minimal scope necessary to adhere to security best practices. Sources: https://www.rfc-editor.org/rfc/rfc6749.txt [source]
[low] Avoid creating new tokens for every request; instead, reuse the token during its 1-hour lifespan to mitigate rate limiting. Sources: https://www.mongodb.com/docs/atlas/configure-api-access.md [source]
[low] Legacy Atlas programmatic API keys use HTTP Digest auth, which is not supported by the connector; users should use service accounts with OAuth2 client_credentials instead. Sources: https://veryfront.com/docs/cloud/integrations/mongodb-atlas.md [source]
[high] Service account access tokens can only be used from IPs on the service account's API access list, and the service account must be a member of the organization hosting the project to avoid 401 errors. Sources: https://www.mongodb.com/docs/atlas/api/api-authentication.md, https://veryfront.com/docs/cloud/integrations/mongodb-atlas.md [source]
[low] Atlas enforces rate limiting for each combination of IP address and SA client, with the token endpoint limited to 50 requests per minute, returning a 429 status code if exceeded. (verified as of 2026-10-15) Sources: https://raw.githubusercontent.com/mongodb/terraform-provider-mongodbatlas/master/docs/guides/provider-configuration.md [source]

Related concepts

Token — is a part of OAuth2 Token Exchange
OAuth2 — is a part of OAuth2 Token Exchange

Children

No children recorded.

← the whole tree · 3D view· how to read this page