For AI agents: a documentation index is available at https://www.mongodb.com/docs/llms.txt — markdown versions of all pages are available by appending .md to any URL path.

agentengine service-account create

Create a service account.

Synopsis

Create a service account and issue its first client secret.

The secret is shown only once; save it immediately.

Exchange the client ID and secret for a 1-hour access token at POST /api/v1/oauth/token. Send that token only to endpoints explicitly enabled for service-account authentication and that the assigned role allows:

curl --fail-with-body --silent --show-error \  --user '<client-id>' \  --data grant_type=client_credentials \  '<base-url>/api/v1/oauth/token' | \jq -er '"Authorization: Bearer " + .access_token' | \curl --fail-with-body --silent --show-error \  --header @- \  '<base-url>/api/v1/<service-account-enabled-resource>'

Project roles are PROJECT_OWNER and PROJECT_READ_ONLY; organization roles are ORG_OWNER, ORG_GROUP_CREATOR, and ORG_READ_ONLY. ORG_OWNER is accepted only where the organization has the owner role enabled; the server rejects it otherwise. List and get display the account's Atlas role.

Creating a service account can also create a paired Atlas service account, which needs Atlas service account pairing turned on for the organization or project. If it is off, the command explains the paired account and, in a terminal, asks before turning it on. Pass --enable-atlas-pairing to turn it on without a prompt, for example in a script. Declining, or omitting the flag without a terminal, creates nothing. When a paired Atlas service account is created, its id is shown with the result.

Examples:

agentengine service-account create ci-pipeline --role PROJECT_OWNERagentengine service-account create audit-reader --org-id <org-id> --role ORG_READ_ONLY
agentengine service-account create <name> --role <role> [flags]

Options

    --base-url string              Platform base URL    --context string               Named context to target (see 'agentengine context list')    --description string           Human-readable description    --enable-atlas-pairing         Turn on Atlas service account pairing for the organization or project if it is off, without a prompt. The notice goes to stderr-h, --help                         help for create    --ip-access-list strings       IPs or CIDRs allowed to use the credential (default: unrestricted)    --json                         Output the created service account as JSON    --org-id string                Organization scope for the service account    --project-id string            Project scope for the service account    --role string                  Role granted to the service account (project: PROJECT_OWNER, PROJECT_READ_ONLY; organization: ORG_OWNER, ORG_GROUP_CREATOR, ORG_READ_ONLY)    --secret-expires-in duration   Secret lifetime as a whole number of hours, e.g. 720h (default: server default of 2160h)

Options inherited from parent commands

    --log-file string    override log file path    --log-level string   file log verbosity (error|warn|info|debug) (default "info")    --no-log             disable file logging-q, --quiet              silence stderr below error-v, --verbose count      raise stderr verbosity (-v info, -vv debug)

See Also

Back
service-account
Next
delete
Rate this page