Skip to main content

​
At a glance

  • Availability: Experimental (how to enable).
  • Authentication: OAuth 2.0 (client credentials).
  • Connection: Veryfront obtains machine-to-machine tokens from the client ID and secret in the project’s environment variables.
  • Provider documentation: Authentication reference.

​
Credentials

Set these per environment. See Connect an integration.

​
Setup

  1. Sign in to Atlas: Go to https://cloud.mongodb.com and sign in (a free M0 cluster is enough for testing).
  2. Create a service account: In Organization Access Manager > Applications > Service Accounts, create a service account with at least Organization Read Only (or Project Read Only on specific projects). Copy the client ID and client secret - the secret is shown only once.
  3. Add your IP to the API access list: Service account access tokens can only be USED from IPs on the service account’s API access list. Add your machine’s IP (or 0.0.0.0/0 for testing only).
  4. Set environment variables: Add MONGODB_ATLAS_CLIENT_ID and MONGODB_ATLAS_CLIENT_SECRET to your .env. Tokens are minted automatically from https://cloud.mongodb.com/api/oauth/token via the OAuth2 client_credentials grant (credentials sent via HTTP Basic).
  5. Verify access: Run List Projects, then List Clusters with a project’s ID.

​
Provider notes

  • Legacy Atlas programmatic API keys use HTTP Digest auth, which this connector does NOT support - use a service account (OAuth2 client_credentials) instead; MongoDB recommends service accounts over API keys
  • Every request must send a versioned Accept header; tools default to application/vnd.atlas.2025-03-12+json (the latest stable resource version). Atlas returns 406 if the header is missing or names a nonexistent version
  • Access tokens expire after 1 hour and are refreshed by re-running the client_credentials grant
Provider API reference.

​
Tools

​
Verify the connection

Call a read tool such as mongodb-atlas__list_projects with arguments for your account. Confirm that the result comes from the intended account or workspace before enabling write tools.