Users and passwords

Every database starts with one main user, shown on the Overview tab. You can give it a new password at any time, and for PostgreSQL, MySQL and MariaDB you can add more users with limited roles, for example a read-only user for reporting.

Only the database’s owner, and workspace members who can see database passwords, can rotate passwords or manage users. New passwords are shown once: copy them before you close the dialog.

Rotate the main password

1. Open the database’s Overview tab and click Rotate password.
2. Confirm. A new random password is set, and the dialog shows it with the new connection string.
3. Update every app that uses the database.

The old password stops working for new connections right away. Connections that are already open stay open until they reconnect.

Engine	What happens
PostgreSQL	Switches immediately.
MySQL	Switches immediately, or after a grace period you choose (up to 24 hours) during which both passwords work. The old one is then removed automatically.
MariaDB	Switches immediately.
Redis	Switches immediately. The database restarts for a moment; your data is kept.

The grace period gives you time to update your apps one at a time without downtime.

Add a database user

PostgreSQL, MySQL and MariaDB only. Redis has a single password.

1. Open the Users & Roles tab.
2. Enter a username (3 to 32 characters: lower-case letters, digits and _, starting with a letter), for example reporting.
3. Pick a role and click Create user.
4. Copy the password shown. The user connects to the same host, port and database as the main user.

Role	Can
Read-only	Read data.
Read/write	Read, insert, update and delete data. Can’t change tables.
Admin	Everything in this database, including creating and changing tables.

No user you create can reach other databases, manage users or change server settings. You can add up to 20 users per database.

To change a user’s password, click Rotate password on its row. To remove a user, click Delete user: its open connections are closed and it can’t log in again.

Backups and new databases

Users you create are part of the database, so a backup restored into the same database keeps them. When you restore a PostgreSQL backup into a new database, the extra users aren’t copied: create them again on the new database.

With the API

# Rotate the main password (MySQL: add a grace period in minutes)
curl -X POST "https://api.dockhive.io/api/v1/databases/$DB/credentials/rotate?region=$REGION" \
  -H "Authorization: Bearer $DOCKHIVE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"grace_minutes": 60}'

# List users
curl "https://api.dockhive.io/api/v1/databases/$DB/users?region=$REGION" \
  -H "Authorization: Bearer $DOCKHIVE_API_KEY"

# Create a read-only user (the password is in this response only)
curl -X POST "https://api.dockhive.io/api/v1/databases/$DB/users?region=$REGION" \
  -H "Authorization: Bearer $DOCKHIVE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"username": "reporting", "role": "read_only"}'

# Rotate a user's password
curl -X POST "https://api.dockhive.io/api/v1/databases/$DB/users/reporting/rotate?region=$REGION" \
  -H "Authorization: Bearer $DOCKHIVE_API_KEY"

# Delete a user
curl -X DELETE "https://api.dockhive.io/api/v1/databases/$DB/users/reporting?region=$REGION" \
  -H "Authorization: Bearer $DOCKHIVE_API_KEY"

Roles in the API are read_only, read_write and admin.