Programmatic API Keys Legacy Auth
Parent: MongoDB Atlas Infrastructure as Code · Published reference · snapshot 2026-10-24 · skill mongodb-cohort-2030af7213e7
↓ Facts as markdownall context files
Source-anchored research for Programmatic API Keys Legacy Auth. Run status: COMPLETED.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
Structure and components
- An Atlas programmatic API key consists of a public key and private key used as username/password inputs to HTTP Digest authentication. MongoDB's demonstration repository implements this flow in Python, Node.js and Ruby. (high confidence) [source]
How it works
- Deleting an API key from its Atlas organization also removes its access to projects in that organization. The documented revocation mechanism is key deletion, which must be coordinated with applications still using that pair. (low confidence) [source]
How-to and procedures
- Use the API credential's access list to restrict source IP addresses or CIDR blocks. The organization-management documentation exposes this setting, and MongoDB's Digest demo explicitly requires adding the caller's IP to the API access list. For a GCP-hosted caller, this means permitting the address Atlas actually sees. (medium confidence) [source]
- Avoid assigning Organization Owner to unattended API keys when narrower roles suffice. Mondoo's Atlas security policy explicitly checks for the absence of ORG_OWNER on API keys; Atlas documentation confirms that role assignments govern key permissions. This is a least-privilege recommendation, not an Atlas prohibition on owner keys. (medium confidence) [source]
Problems, failure modes and limitations
- Each Atlas API key pair belongs to one organization and can access multiple projects within it; assigned Atlas roles limit its operations. When discovery returns no resources, check organization ownership, role assignments and project access. (high confidence) [source]
- For rejected Atlas discovery credentials, Microsoft recommends reviewing the API public/private key pair. HTTP 401 usually indicates authentication failure, while HTTP 403 usually indicates insufficient resource access; network restrictions can also require attention, so status alone is not a complete diagnosis. (low confidence) (verified as of 2026-10-21) [source]
Comparisons and alternatives
- For API-key requests, configure the API credential access list for the automation host source IP or CIDR. This differs from the project IP access list and private networking used for database connections. A missing required API access-list entry can produce HTTP 403. (high confidence) (verified as of 2026-10-14) [source]
- Atlas service-account access tokens last one hour and cannot be refreshed; clients generate a new token near expiry and can reuse an existing token for multiple requests. Adopting OAuth therefore adds token lifecycle handling rather than simply renaming the API-key fields. (high confidence) (verified as of 2026-10-14) [source]
Facts and statements
- MongoDB labels API keys a legacy authentication method and recommends Atlas service accounts using OAuth 2.0 client credentials. The reviewed documentation still supports API keys; the legacy label alone does not establish a removal deadline. (high confidence) (verified as of 2026-10-14) [source]
- Atlas Administration API credentials grant administrative API access, not Atlas UI login or direct access to cluster data. Database reads and writes require database-user credentials; Microsoft also separates Atlas resource discovery credentials from database credentials. (high confidence) [source]
- An Elastic integration enhancement request dated 2026-04-28 reports that mongodb_atlas integration 1.2.0 with agent 9.3.0 exposed only public/private API key fields and lacked OAuth client-credentials support. Treat this as version-specific user-reported migration friction, not proof that all current Elastic releases lack service accounts. (low confidence) (verified as of 2026-04-28) [source]
- The Terraform Atlas provider documents both service-account and programmatic-key authentication. Its migration procedure replaces provider attributes or environment variables with service-account credentials and runs terraform plan; its guide warns that mongodbatlas_event_trigger resources do not yet support service accounts. (low confidence) (verified as of 2026-10-23) [source]
- Atlas API keys use HTTP Digest authentication with a public key and private key acting as username and password; MongoDB shows curl requests using --user "{PUBLIC-KEY}:{PRIVATE-KEY}" with --digest. (high confidence) [source]
- The Atlas Administration API is reachable over the public Internet only, not through cluster network peering or private endpoints. For automation managing Atlas on GCP, a private cluster connection therefore does not establish an Administration API network path. (low confidence) (verified as of 2026-10-14) [source]
- Elastic MongoDB Atlas integration documentation for version 1.3.1 requires a Public Key, Private Key, Group ID and Organization ID during setup. This is evidence of a documented key-based integration path, not proof that every Atlas integration supports OAuth migration. (low confidence) (verified as of 2026-08-04) [source]
- MongoDB displays an API private key only at creation and instructs users to save it securely. Deleting an organization API key also removes its access to projects in that organization. (low confidence) (verified as of 2026-10-14) [source]
Children
- No children recorded.