Getting Started

Overview

This guide prepares your environment for JIT MongoDB Atlas access using the Britive Access Broker. The broker calls the Atlas Administration API to create and delete database users — no permanent credentials are stored in Atlas.

Before You Begin

A Britive tenant with administrator access
A running Britive Access Broker (Linux or Windows host with outbound HTTPS)
curl and jq installed on the broker host
MongoDB Atlas organization access with Organization Owner rights to create API keys
A broker pool token from Resource Manager → Broker Pools → New Pool in the Britive console

Step 1 — Create an Atlas API Key

The broker authenticates to the Atlas Administration API using Digest Auth with a public/private key pair.

Open API key management

In the Atlas console, go to Organization → Access Manager → API Keys → Create API Key.

Set the role

Assign the Organization Project Creator role at minimum. For managing database users within a project, assign Project Owner on the target project.

Save the keys

Copy both the public key and private key — the private key is shown only once.

Store in Britive Secrets Store

In the Britive console, go to Secrets Manager → New Secret. Store the private key. Reference it as an environment variable in the broker permission scripts rather than hardcoding it.

Step 2 — Verify Broker Host Dependencies

The checkout/checkin routines use curl for Atlas API calls and jq for JSON parsing.

# Install on Debian/Ubuntu
sudo apt-get install -y curl jq

# Install on RHEL/Amazon Linux
sudo dnf install -y curl jq

# Verify
curl --version && jq --version

Step 3 — Register the Atlas Project as a Resource

Create a resource type

In the Britive console, go to Resource Manager → Resource Types → New Resource Type. Name it MongoDBAtlas.

Add parameters:

Parameter	Type	Required
`project_id`	string	Yes
`cluster_name`	string	Yes

Register the resource

Go to Resource Manager → Resources → New Resource. Select the MongoDBAtlas resource type.

Set parameter values:

Parameter	Value
`project_id`	Your Atlas project ID (from Project → Settings in the Atlas console)
`cluster_name`	The cluster name

Assign a broker pool

Under Broker Pools, select the pool containing the broker that has outbound HTTPS to cloud.mongodb.com.

Verify

Confirm the broker can reach the Atlas API:

# Replace with your actual public and private keys and project ID
curl --user "publicKey:privateKey" \
  --digest \
  --header "Accept: application/vnd.atlas.2023-01-01+json" \
  "https://cloud.mongodb.com/api/atlas/v2/groups/{PROJECT_ID}/databaseUsers"

A 200 OK response with a JSON array confirms API access. An empty array ([]) is expected if no database users exist.

Troubleshoot

Symptom	Cause	Fix
`HTTP 401` on API call	Incorrect key pair or digest auth issue	Verify public/private key pair; Atlas API requires Digest Auth, not Basic Auth
`HTTP 403`	API key lacks project permissions	Assign the key the Project Owner role on the target project
`jq: command not found`	`jq` not installed on broker	Install with `apt-get install jq` or `dnf install jq`
Broker pool shows disconnected	Broker cannot reach Britive	Verify outbound HTTPS (port 443) from broker to your Britive tenant

Last updated on July 8, 2026

Temporary Database User