Skippr Docs

Appearance

How to Manage MongoDB Source Credentials in Skippr ​

July 2026

Keep MongoDB source credentials safe by moving the connection string into MONGODB_CONNECTION_STRING, leaving database and collection selection visible, and using a user that only needs read access to the target collection.

Short Answer ​

Manage MongoDB source credentials in Skippr by keeping the connection string out of skippr.yaml and loading it from MONGODB_CONNECTION_STRING. The docs are explicit that connection_string is the secret-bearing field, while database, collection, and any optional filter define what Skippr should read.

That is the right separation because a MongoDB URI usually bundles username, password, host, and auth settings in one value. You still want the chosen database and collection visible in config so another engineer can review the pipeline boundary without seeing the credential that opens it.

Why Teams Struggle with This ​

MongoDB credential handling goes wrong when teams treat the full URI as normal config. Once a password lives inside a checked-in connection string, every copy of the file becomes a secret copy, and the problem is much bigger than one connector.

  • A literal mongodb://user:pass@host:27017 string in config exposes the password and often the authentication database details too.
  • Using a broad admin user for extraction makes one leaked URI far more damaging than it needs to be.
  • Changing the filter is a data selection choice and should not require a new credential.
  • If the runner cannot reach the MongoDB endpoint, replacing the URI with a new secret will not address the actual outage.

How Skippr Handles It ​

Skippr keeps the MongoDB connector compact. One environment-backed connection_string unlocks the server, then database, collection, and filter keep the read contract explicit and reviewable.

That is especially helpful when the collection later participates in CDC through change streams. The identity can stay consistent while the pipeline behavior evolves, instead of creating a second secret path for the same source.

  • Uses connection_string: ${MONGODB_CONNECTION_STRING} for the secret-bearing value.
  • Keeps database, collection, and optional filter as plain config.
  • Fits a least-privilege MongoDB user with read access to the target collection.
  • Lets teams review collection scope without revealing the actual URI.

What the First Useful Version Looks Like ​

The first useful version is one MongoDB user, one database, one collection, and one environment-provided URI. That proves the connector and the privilege boundary with very little surface area.

If you need a filtered extract, add the filter in config after the URI is already stable, so the secret and the dataset selection remain clearly separated.