Database Credential Rotations for Render Postgres

You can add and delete PostgreSQL credentials for your Render Postgres database user. This is most commonly helpful for performing a credential rotation.

Any users you create via the Render Dashboard or API are listed in the Credentials section of your database's Info page:

Render provides enhanced management of these users, including automatic updates to Blueprint-managed environment variables that reference the database's connection string.

Users created directly with the CREATE USER command are not managed by Render.

• These users are not displayed in the Render Dashboard or API.
• These users do not replace your database's default user on creation.

Managing PostgreSQL users

The default user

Whenever you add a PostgreSQL user to your database, that user becomes the database's new "default" user:

• The default user's credentials appear in your database's connection URLs shown in the Render Dashboard.
• Default user credentials are also used by environment variables that reference connection strings in a Render Blueprint.
  • Whenever the default user changes, these environment variables update their value on the next Blueprint sync.
• All other existing PostgreSQL users remain valid. However, you can no longer view credentials for the previous default user.

Adding a user

Add a new Render-managed PostgreSQL user to your database with any of the following methods:

Users created directly with the CREATE USER command are not managed by Render.

• These users are not displayed in the Render Dashboard or API.
• These users do not replace your database's default user on creation.

Viewing users

You can view the active PostgreSQL users for your database. Note that these methods only show users that you added with one of the methods above, not built-in PostgreSQL roles or users created via CREATE USER.

Deleting a user

You can delete PostgreSQL users if they have compromised credentials or are no longer needed.

You can't delete your database's current default user.

To perform a credential rotation involving the default user, first create a new user to make it the new default. You can then delete the previous default user.

Render never fully deletes your database's original user.

If you "delete" the original user, Render actually deactivates it by revoking its login privileges. This is a safeguard to preserve database objects owned by the original user.

Rotating credentials

The following diagram illustrates performing a zero-downtime credential rotation for your database (steps described below):

1. Add a new PostgreSQL user to your database.

2. Update the configuration of all apps and services that connect to your database to use the new user's credentials.

   • For Blueprint-managed services that dynamically reference the database's connection string, perform a manual Blueprint sync to update the environment variable.

3. Redeploy all of your connected apps and services with the updated credentials.

4. Monitor your database to confirm when no connections are using the original user's credentials.

   You can help confirm this with a query like the following (substitute the original user's name where indicated):

5. Delete the original user.

Webhook support

Credential management actions trigger the following webhook events: