= Connecting your MongoDB
:nav-title: Your own MongoDB
:description: Run a Dedicated service on your own MongoDB, on Atlas or self-hosted: the connection string, the network settings to open, and where the service keeps its data.
:keywords: bring your own MongoDB, MongoDB Atlas connection string, dedicated backend, connect Atlas cluster, TLS MongoDB
:group: Reference
:order: 20

A **Dedicated** service does not come with a database. It runs in front of a MongoDB you own, on https://www.mongodb.com/atlas[MongoDB Atlas] or anywhere else, and your data never leaves it. The service needs the connection string before it can start.

On Free and Shared, MongoDB is included and there is nothing to do.

== What you need

* A MongoDB **6.0 or later**, reachable from the internet over TLS. Atlas on AWS, GCP or Azure, any tier; a server of yours; or a compatible service that speaks the MongoDB protocol.
* A database user for the service with `readWrite` on your database and `read` on `admin`. Make one for this purpose rather than reusing an admin.
* The connection string:

[source]
----
mongodb+srv://<user>:<password>@<host>/<database>?retryWrites=true&w=majority
----

A password with special characters must be URL-encoded. Without SRV, use `mongodb://<user>:<password>@<host>:<port>/<database>?tls=true&retryWrites=true`.

== Open the network

The service connects from fixed IP addresses. Add them to your MongoDB's network access list, in Atlas under **Network Access**. Ask support from the console for the current addresses of your region.

TLS is required: Atlas has it on by default; on a server of yours, set `net.tls.mode: requireTLS`. Port 27017, or your own, must be open to those addresses.

== Give it to the service

When you create the service and choose **Dedicated**, paste the connection string in the **MongoDB connection** step. The service checks that it can reach the database and sign in before it starts. If the check fails, look at the string, the network access list, the user's rights and TLS, in that order.

To change the string later, for a rotated password or a new cluster, use the service's **Settings**. The service reconnects; its address does not change.

== Where the service keeps its own data

The service stores its users, permissions and GraphQL apps in a database called `restheart` inside your MongoDB, and its schemas in `_schemas`:

[cols="2,2"]
|===
| Collection | Path on Dedicated

| Users | `/restheart/users`
| Permissions | `/restheart/acl`
| GraphQL apps | `/restheart/gql-apps`
| Schemas | `/_schemas`
|===

Keep your own collections out of the `restheart` database. The console uses these paths for you; a script of yours must use them too. See xref:plans.adoc[what differs between plans].

== Related pages

* xref:plans.adoc[Plans]: everything else that changes on Dedicated.
* xref:getting-started.adoc[Getting Started]: the first steps once the service is up.