Users and roles

Create users with MongoDB's built-in roles or with your own roles.

User and role commands are MongoDB's, and each command is authorized before it runs: without the privilege, it answers Unauthorized (13).

One user per application

JavaScript

db.getSiblingDB("admin").createUser({
  user: "shop-api",
  pwd: passwordPrompt(),
  roles: [{ role: "readWrite", db: "shop" }],
});

Built-in roles

read, readWrite, dbAdmin, dbOwner, userAdmin, clusterAdmin, clusterManager, clusterMonitor, enableSharding, hostManager, backup, restore, readAnyDatabase, readWriteAnyDatabase, userAdminAnyDatabase, dbAdminAnyDatabase and root, with the same privileges as in MongoDB.

Your own roles

JavaScript

db.getSiblingDB("admin").createRole({
  role: "reports",
  privileges: [{ resource: { db: "shop", collection: "orders" }, actions: ["find"] }],
  roles: [],
});

Revoke

When you revoke a role or drop a user, the command answers only once no node can authorize with the previous state. There is no window in which another node still lets the revoked user through.

API keys for the REST API and the MCP server are created for a user and carry a subset of its roles: see REST API.

PreviousAuthentication NextEncryption at rest