Database users and passwords
Every database has a main user with a strong password made for you. Add read-only or read-write users, and change a password without downtime.
Updated 17 Oct 20263 min read
Every database comes with a main user and a strong password, made for you: 32 random letters and digits. It's stored encrypted and never written in a log. You can add up to 10 extra users to a MySQL, MariaDB or PostgreSQL database, each reading and writing or reading only, and change the main password whenever you like.
The main user
| Database | Main user and database name |
|---|---|
| Own MySQL, MariaDB or PostgreSQL | db_ and the project's name, like db_duka |
| Shared MySQL | t and twelve letters and digits, the same for the database |
| Valkey | default, with a password only |
The main user is what attached apps use. Its password is in the database's Connect section, and in the apps' variables.
Add a user
Extra users are like cPanel's MySQL users: a separate login, with its own password, for a report, an accountant's tool or a second app.
Open the database from your project's Overview.
Under Users, choose Add a user.
Type a name: up to 32 lowercase letters, numbers and underscores, starting with a letter.
Under What it may do, choose Reads and writes or Reads only, then choose Add.
Use the copy button next to its name to copy its password.
Names the database keeps for itself, like root, mysql, postgres or sys, can't be used.
On a shared MySQL, a user's name starts with its database's own name, so it never meets another customer's user: reports becomes the main user's name, then _reports. If the whole name is too long, you're asked for a shorter one.
Example: a read-only user for reports
Asha's accountant wants to pull monthly sales from duka. Asha adds a user reports with Reads only, copies its password, and gives both to the accountant's reporting script, which she runs as a scheduled task of her app. The script can read every table and change nothing. When the accountant's contract ends, Asha chooses Remove reports: it's dropped from the database and every connection it had open ends.
Change a password
Choose Change the password in the database's Connect section. A new password is made, set in the database first, then in the variables of every attached app, which restart side by side with the new one.
| Database | What happens to the old password |
|---|---|
| MySQL, shared or own | It keeps working beside the new one until every attached app runs with the new one, a day at most. No downtime. |
| MariaDB and PostgreSQL | It stops at once. For the seconds until the apps restart, a new connection with it is refused; open connections carry on. |
| Valkey | Valkey restarts with the new one, and the apps restart with it. |
Change the password if you think someone saw it, for example in a screenshot or a shared .env file. Change the password is for the main user. To give an extra user a new password, remove it and add it again.
Removing a user
Remove drops the user from the database and ends its connections. On PostgreSQL, the tables and other things it made go to the main user first, so nothing is lost. If a removal fails, the page says why, and you can send it again.
Good habits
Let apps use the attached variables, so a new password reaches them by itself. A password you copied into a variable of your own doesn't follow.
Give each tool its own user, so you can remove one without touching the others.
Use Reads only for anything that only reads.