How to rotate your MongoDB Atlas database password

Updated October 2026

Your app logs in to MongoDB Atlas with a database user: the name and password inside MONGODB_URI. To change it with no downtime, make a second user with the same roles, switch your app to it, then delete the old user.

The manual steps

1. Open Database Access in your Atlas project.
2. Add a new database user with the same roles as your app's user, limited to the same cluster.
3. Build the new connection string with the new name and password.
4. Update every place MONGODB_URI lives, then redeploy.
5. Delete the old user once your app runs on the new one.

What breaks if you miss a place

Anything still using the old connection string loses its database the moment you delete the old user. Atlas also takes a short while to apply a user change across the cluster, so a brand new user may not log in for a few seconds.

How to check the old password is actually dead

There is no cheap web call for this. You open a real connection with the old string and send a ping. If the old user is gone, the login is refused.

You can do it by API

With an Atlas API key, create a database user with POST /api/atlas/v2/groups/{groupId}/databaseUsers, and delete one the same way. You pick the password. Atlas never makes one for you. This works on the free M0 tier too.

Or let Key Robot do it

Key Robot does this for you today, with an Atlas API key you make once. Two robot database users take turns. Each change gives the next one a new password and the same roles as your app's user, on your app's cluster only. The robot waits until Atlas has applied the change and the new string logs in, puts it in your app on Netlify, Vercel, Render, Railway or Cloudflare Workers, checks your app, and then deletes the old robot user. It never writes any other user.

In our live test on October 26, 2026, one change took 64 seconds. About 25 of them were Atlas applying the user change. The old string was refused 4.3 seconds after the change.

See how to rotate your Neon database password for the same two-user idea on Postgres, or the rotate hub for every service.