The key only needs the Organization Read Only role. TigerGate can never
change clusters, network access rules, or database users.
Before you start
In TigerGate, open Integrations → Cloud Providers and add a MongoDB Atlas connection. You’ll fill in three values:| Value | What it is |
|---|---|
| Public Key | Atlas API public key. |
| Private Key | Atlas API private key — from the same key pair as the public key. |
| Organization ID (optional) | Restricts the connection to a single Atlas organization — leave blank to use whatever the key can access. |
1. Create the API key
Open Organization Access Manager
In Atlas, go to your Organization → Access Manager → API Keys →
Create API Key.
Set the role and description
Name it
TigerGate CSPM Scan and assign the Organization Read Only
role — no write permissions are needed.2. Connect it in TigerGate
Paste both keys
In Integrations → Cloud Providers, add a MongoDB Atlas connection
and enter the Public Key and Private Key. Set Organization ID
(Organization → Settings) if you belong to multiple Atlas organizations
and want to restrict the scan to one.
Test
Click Test. TigerGate confirms both the Public Key and Private
Key are present. The keys themselves are validated against the Atlas
Administration API when the first scan runs, so a bad key or an IP block
surfaces on the scan rather than at Test time.
Troubleshooting
| Scan error | Cause | Fix |
|---|---|---|
401 Unauthorized | Wrong public/private key pair | Re-copy both from the same API key |
403 Forbidden from an IP not on the access list | The key has an IP access list and TigerGate’s range isn’t on it | Add TigerGate’s IP range to the key’s Access List, or remove the list |
| Organization not found | Organization ID doesn’t match, or the key isn’t scoped to it | Verify the ID under Organization → Settings, or leave the field blank |
| Scan runs but few findings | Key role is narrower than Organization Read Only (e.g. project-level only) | Re-create the key at the organization level with Organization Read Only |