> For the complete MongoDB documentation index, see www.mongodb.com/docs/llms.txt

# Manage Programmatic Access to an Organization

Use the following procedures to manage programmatic access to an organization. To learn more, see [Grant Programmatic Access to an Organization.](https://www.mongodb.com/docs/atlas/configure-api-access.md#std-label-about-org-api-keys)

**Important:**

We recommend you use service accounts instead of API (Application Programming Interface) keys to authenticate to the Atlas Administration API. API (Application Programming Interface) keys are a legacy authentication method.

## Required Access

To perform any of the following actions, you must have [`Organization Owner`](https://www.mongodb.com/docs/atlas/reference/user-roles.md#mongodb-authrole-Organization-Owner) access to Atlas.

## View Programmatic Access to an Organization

You can view the details of all service accounts or API (Application Programming Interface) keys that have access to your organization.

1. In Atlas, go to the Applications page.

   If it's not already displayed, select your desired organization from the  Organizations menu in the navigation bar.

   Click Applications in the sidebar under the Identity & Access section.

   The [Applications](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%23%2Forg%2F%3Corganization%3E%2Faccess%2FserviceAccounts) page displays.

2. Click the Applications tab.

3. Click Service Accounts.

4. Click the name of a service account.

5. View the details of the service account.

   The details include:

   - The obfuscated client secret for the service account

   - The date the client secret was last used

   - The date the client secret was created

   - The IP (Internet Protocol) addresses from which the service account can access the API (Application Programming Interface)

   - The [roles](https://www.mongodb.com/docs/atlas/reference/user-roles.md#std-label-organization-roles) the service account has been assigned

You can use the Atlas Administration API to [list the names and details of the service accounts that have access to your organization.](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-listserviceaccounts)

To view the details of an API (Application Programming Interface) key in an organization using the Atlas UI, follow these steps:

1. In Atlas, go to the Applications page.

   If it's not already displayed, select your desired organization from the  Organizations menu in the navigation bar.

   Click Applications in the sidebar under the Identity & Access section.

   The [Applications](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%23%2Forg%2F%3Corganization%3E%2Faccess%2FserviceAccounts) page displays.

2. Click the Applications tab.

3. Click API Keys.

4. View the Access List.

   Click  to the right of the API (Application Programming Interface) Key.

   Click View Details.

   The \<Public Key> API Key Details modal displays:

   - The obfuscated Private Key

   - The date the Key was last used

   - The date the Key was created

   - The IP (Internet Protocol) addresses from which the Key can access the API (Application Programming Interface)

   - The projects to which the Key has been granted access

You can view a list of API (Application Programming Interface) keys, the details of an API (Application Programming Interface) key, or the access list for an API (Application Programming Interface) key in an organization using the Atlas CLI.

### View API (Application Programming Interface) Keys

To list all API keys in an organization using the Atlas CLI, run the following command:

```sh

atlas organizations apiKeys list [options]

```

To return the details for an API key in an organization using the Atlas CLI, run the following command:

```sh

atlas organizations apiKeys describe <ID> [options]

```

To learn more about the syntax and parameters for the previous commands, see the Atlas CLI documentation for [atlas organizations apiKeys list](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-organizations-apiKeys-list/) and [atlas organizations apiKeys describe.](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-organizations-apiKeys-describe/)

### View API (Application Programming Interface) Access List Entries for the API (Application Programming Interface) Key

To list IP access list entries for your API key using the Atlas CLI, run the following command:

```sh

atlas organizations apiKeys accessLists list <apiKeyID> [options]

```

To learn more about the command syntax and parameters, see the Atlas CLI documentation for [atlas organizations apiKeys accessLists list.](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-organizations-apiKeys-accessLists-list/)

## Update Programmatic Access to an Organization

You can change the roles, name, description, or access list for a service account in an organization using the Atlas UI. You can also generate a new client secret.

1. In Atlas, go to the Applications page.

   If it's not already displayed, select your desired organization from the  Organizations menu in the navigation bar.

   Click Applications in the sidebar under the Identity & Access section.

   The [Applications](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%23%2Forg%2F%3Corganization%3E%2Faccess%2FserviceAccounts) page displays.

2. Click the Applications tab.

3. Click Service Accounts.

4. Click the name of a service account.

5. Edit the Service Account Info.

   To modify the Name or Description, click .

6. Generate a new client secret.

   Click Generate New Client Secret

   Choose a duration for the client secret from the menu. The client secret expires after this duration.

   Click Generate New.

   Click Copy and save the client secret to a secure location. This is the only time you can view the full client secret.

7. Edit the Organization Permissions.

   Click Edit Permissions.

   From the Organization Permissions menu, select the [new role or roles](https://www.mongodb.com/docs/atlas/reference/user-roles.md#std-label-organization-roles) for the service account.

   Click Save and next.

   **Important:**

   The service account credentials remain active until they expire or are revoked.

8. Edit the API Access List.

   To add an IP (Internet Protocol) address or CIDR (Classless Inter-Domain Routing) block from which you want Atlas to accept API (Application Programming Interface) requests for this service account, click Add Access List Entry and type an IP (Internet Protocol) address.

   You can also click Use Current IP Address if the host you are using to access Atlas also will make API (Application Programming Interface) requests using this service account.

   To remove an IP (Internet Protocol) address from the access list, click  to the right of the IP (Internet Protocol) address.

   Click Save.

You can use the Atlas Administration API to:

- [Update service account details.](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-updateorgserviceaccount)

- [Generate a new client secret.](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-createorgserviceaccountsecret)

- [Update the service account's IP access list.](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-updateorgserviceaccount)

You can change the roles, description, or access list for an API (Application Programming Interface) Key in an organization using the Atlas UI.

1. In Atlas, go to the Applications page.

   If it's not already displayed, select your desired organization from the  Organizations menu in the navigation bar.

   Click Applications in the sidebar under the Identity & Access section.

   The [Applications](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%23%2Forg%2F%3Corganization%3E%2Faccess%2FserviceAccounts) page displays.

2. Click the Applications tab.

3. Click API Keys.

4. From the ellipsis menu to the right of the API (Application Programming Interface) Key you want to change, click Edit.

5. Edit the API Key Information.

   On the Add API Key page:

   Modify the Description.

   In the Organization Permissions menu, select the [new role or roles](https://www.mongodb.com/docs/atlas/reference/user-roles.md#std-label-organization-roles) for the API (Application Programming Interface) key.

6. Click Next.

7. Edit the API Access List.

   To add an IP (Internet Protocol) address or CIDR (Classless Inter-Domain Routing) block from which you want Atlas to accept API (Application Programming Interface) requests for this API (Application Programming Interface) Key, click Add Access list Entry and type an IP (Internet Protocol) address.

   You can also click Use Current IP Address if the host you are using to access Atlas also will make API (Application Programming Interface) requests using this API (Application Programming Interface) Key.

   To remove an IP (Internet Protocol) address from the access list, click  to the right of the IP (Internet Protocol) address.

   Click Save.

8. Click Done.

You can change the roles or access list for an API (Application Programming Interface) key in an organization using the Atlas CLI.

### Change an API (Application Programming Interface) Key's Roles

To update an API key in an organization using the Atlas CLI, run the following command:

```sh

atlas organizations apiKeys assign <apiKeyId> [options]

```

To learn more about the command syntax and parameters, see the Atlas CLI documentation for [atlas organizations apiKeys assign.](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-organizations-apiKeys-assign/)

### Add an API (Application Programming Interface) Access List Entry for the API (Application Programming Interface) Key

To create an IP access list entry for your API key using the Atlas CLI, run the following command:

```sh

atlas organizations apiKeys accessLists create [options]

```

To learn more about the command syntax and parameters, see the Atlas CLI documentation for [atlas organizations apiKeys accessLists create.](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-organizations-apiKeys-accessLists-create/)

### Delete an API (Application Programming Interface) Access List Entry for the API (Application Programming Interface) Key

To delete an IP access list entry for your API key using the Atlas CLI, run the following command:

```sh

atlas organizations apiKeys accessLists delete <entry> [options]

```

To learn more about the command syntax and parameters, see the Atlas CLI documentation for [atlas organizations apiKeys accessLists delete.](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-organizations-apiKeys-accessLists-delete/)

## Revoke Programmatic Access to an Organization

To revoke programmatic access to an organization through the Atlas Administration API, you can delete any existing service accounts for that organization.

1. In Atlas, go to the Applications page.

   If it's not already displayed, select your desired organization from the  Organizations menu in the navigation bar.

   Click Applications in the sidebar under the Identity & Access section.

   The [Applications](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%23%2Forg%2F%3Corganization%3E%2Faccess%2FserviceAccounts) page displays.

2. Click the Applications tab.

3. Click Service Accounts.

4. Delete the service account.

   Click the  icon under Actions to the right of the service account you want to delete.

   Click Delete.

   Deleting a service account from an organization also removes it from from any projects to which the service account was granted access.

To revoke programmatic access to an organization through the Atlas Administration API, you can delete any existing service accounts for that organization.

You can use the Atlas Administration API to:

- [Delete a service account secret.](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-deleteorgserviceaccountsecret)

- [Delete a service account.](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-deleteorgserviceaccount)

To revoke programmatic access to an organization through the Atlas Administration API, you can delete any existing API (Application Programming Interface) keys for that organization.

1. In Atlas, go to the Applications page.

   If it's not already displayed, select your desired organization from the  Organizations menu in the navigation bar.

   Click Applications in the sidebar under the Identity & Access section.

   The [Applications](https://cloud.mongodb.com/go?l=https%3A%2F%2Fcloud.mongodb.com%2Fv2%23%2Forg%2F%3Corganization%3E%2Faccess%2FserviceAccounts) page displays.

2. Click the Applications tab.

3. Click API Keys.

4. Click  to the right of the API (Application Programming Interface) Key that you want to delete.

5. Click Delete to confirm that you want to delete this API (Application Programming Interface) Key or Cancel to leave the key in the Organization.

   Removing an API (Application Programming Interface) Key from an Organization also removes that key from any projects to which the key was granted access.

To revoke programmatic access to an organization through the Atlas Administration API, you can delete any existing API (Application Programming Interface) keys for that organization.

To delete an API key from an organization using the Atlas CLI, run the following command:

```sh

atlas organizations apiKeys delete <ID> [options]

```

To learn more about the command syntax and parameters, see the Atlas CLI documentation for [atlas organizations apiKeys delete.](https://www.mongodb.com/docs/atlas/cli/current/command/atlas-organizations-apiKeys-delete/)

To delete an access list entry for an API (Application Programming Interface) key in an organization, see [Update Programmatic Access to an Organization.](https://www.mongodb.com/docs/atlas/configure-api-access-org.md#std-label-change-org-api-key-roles)