> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# MongoDB accounts

> Give people and agents access to a MongoDB database without sharing its credentials.

A MongoDB [account](https://infisical.com/docs/documentation/platform/pam/accounts/overview.md) stores the credentials for one MongoDB user. Members connect to the database through the Infisical CLI, and Infisical records every command they run.

## Prerequisites

* The Admin [role](https://infisical.com/docs/documentation/platform/pam/concepts/access-control.md) on the [folder](https://infisical.com/docs/documentation/platform/pam/folders/overview.md) you'll add the account to
* A [gateway](https://infisical.com/docs/documentation/platform/gateways/overview.md) that can reach the database
* A MongoDB [account template](https://infisical.com/docs/documentation/platform/pam/templates/overview.md)

## Create the account

**Step 1**

Go to **Privileged Access Management** > **Accounts** and select **Add Account**.

**Step 2**

Select the **Folder** and a MongoDB **Account Template**, then select **Next**.

**Step 3**

Enter a **Name** and the connection details:

| Field | Description |
| - | - |
| **Connection String** | The database's `mongodb://` or `mongodb+srv://` URI, without a username, password, or database, such as `mongodb+srv://cluster.example.com` |
| **Database** | The database that sessions connect to (defaults to `admin`) |
| **SSL Enabled** | Whether to connect over TLS |
| **Reject Unauthorized** | Whether to reject a server certificate that can't be verified (shown when **SSL Enabled** is on) |
| **SSL Certificate** | The CA certificate that signed the server's certificate (shown when **SSL Enabled** is on) |

**Step 4**

Enter the **Username** and **Password** of the MongoDB user, then select **Create**.

## Connect

To open a session, follow [Connect to an account](https://infisical.com/docs/documentation/platform/pam/accounts/connect.md). MongoDB accounts don't support the browser, so use the CLI.

Start the local proxy:

```bash theme={"dark"}
infisical pam access backend-team/users-db
```

The proxy keeps running in that terminal and prints its port. In a second terminal, connect your MongoDB client, such as `mongosh`, to that port:

```bash theme={"dark"}
mongosh "mongodb://localhost:<port>/users"
```

The proxy signs in for you, so the client doesn't need a password.

## Next steps

> [card] [Sessions](https://infisical.com/docs/documentation/platform/pam/sessions/overview)
>
> Review and end the connections that people and agents make to your accounts.

> [card] [Access requests](https://infisical.com/docs/documentation/platform/pam/access-requests/overview.md)
>
> Require approval before a member can use a sensitive account.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.