Database users & roles
Create bounded database users with auto-generated, show-once passwords — never superuser, never able to break HA.
Managed clusters issue bounded database users. Every user is scoped to a preset role and is provisioned by the operator on the cluster — a user never gets superuser, replication, or the ability to break high availability.
Role presets
| Preset | Scope | Grants |
|---|---|---|
| Admin | Cluster-wide | Reads and writes all data, creates tables in public and can create databases. Cannot create roles (database users are created only through Relay) and is never a superuser. |
| Read / write | Selected databases | Read and write within the databases you select, including tables other users create later. |
| Read only | Selected databases | Read-only access to the databases you select, including tables other users create later. |
Read/write and read-only users require you to pick at least one target logical database; a single user can cover several.
Show-once passwords
Leave the password blank when creating a user and Relay generates a strong (256-bit) password and returns it once, in a reveal dialog — copy it immediately, it is never shown again. On edit, leaving the password blank keeps the current one; setting a new value rotates it.
The generated password is shown exactly once at creation. If you lose it, rotate the user's password rather than trying to recover the old one.
Authentication uses password (SCRAM-SHA-256).
Guardrails
- Username — lowercase, starts with a letter or underscore, up to 63
characters, no hyphens (
^[a-z_][a-z0-9_]*$). - Connection limit — cap concurrent connections for the user; blank or
-1means unlimited. - Statement timeout — e.g.
30sor5min; blank uses the cluster default. - Temporary user — optionally auto-delete the user after 6 hours, 1 day, or 1 week.
From the dashboard
Open a cluster's Users tab to create, edit, or delete users, and to reveal a
newly generated password. Managing users requires the org.database_users.*
permission (see RBAC).