> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cockroachlabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Manage Cluster User Authorization

This page documents procedures for managing the lifecycle of SQL users and roles on CockroachDB clusters.

Procedures for managing access are covered in [Managing Access in CockroachDB Cloud](https://docs.cockroachlabs.com/docs/cockroachcloud/managing-access.md).

> [!NOTE]
>
> The concept of *Organization user* is distinct from Authorization of *SQL user/role* on clusters is distinct from authorization of CockroachDB Cloud users within CockroachDB Cloud organizations.
>
> Learn more: [Overview of the CockroachDB Cloud authorization model](https://docs.cockroachlabs.com/docs/cockroachcloud/authorization.md#overview-of-the-cockroachdb-cloud-authorization-model)
> For reference documentation and explanation of related concepts, see [Security Reference — Authorization](https://docs.cockroachlabs.com/docs/stable/security-reference/authorization.md).

## Create CockroachDB users

Use the [`CREATE USER`](https://docs.cockroachlabs.com/docs/stable/create-user) and [`DROP USER`](https://docs.cockroachlabs.com/docs/stable/drop-user) statements to create and remove users, the [`ALTER USER`](https://docs.cockroachlabs.com/docs/stable/alter-user) statement to add or change a user's password and role options, the [`GRANT`](https://docs.cockroachlabs.com/docs/stable/grant) and [`REVOKE`](https://docs.cockroachlabs.com/docs/stable/revoke) statements to manage the user’s privileges, and the [`SHOW USERS`](https://docs.cockroachlabs.com/docs/stable/show-users) statement to list users.

A new user must be granted the required privileges for each database and table that the user needs to access.

> [!NOTE]
>
> By default, a new user belongs to the `public` role and has no privileges other than those assigned to the `public` role.

## Create and manage roles

For examples showing how to create and manage your cluster's users and roles, see the following documentation:

| Statement | Description |
| - | - |
| [`CREATE ROLE`](https://docs.cockroachlabs.com/docs/stable/create-role) | Create SQL roles. |
| [`DROP ROLE`](https://docs.cockroachlabs.com/docs/stable/drop-role) | Remove one or more SQL roles. |
| [`ALTER ROLE`](https://docs.cockroachlabs.com/docs/stable/alter-role) | Change passwords, role options, and default session variables for a role. |
| [`CREATE USER`](https://docs.cockroachlabs.com/docs/stable/create-user) | Create SQL users. |
| [`DROP USER`](https://docs.cockroachlabs.com/docs/stable/create-user) | Remove one or more SQL users. |
| [`ALTER USER`](https://docs.cockroachlabs.com/docs/stable/alter-user) | Change passwords and role options for a user. |
| [`GRANT`](https://docs.cockroachlabs.com/docs/stable/grant) | Manage each role or user's SQL privileges for interacting with specific databases and tables, or add a role or user as a member to a role. |
| [`REVOKE`](https://docs.cockroachlabs.com/docs/stable/revoke) | Revoke privileges from users and/or roles, or revoke a role or user's membership to a role. |
| [`SHOW ROLES`](https://docs.cockroachlabs.com/docs/stable/show-roles) | List the roles for all databases. |
| [`SHOW GRANTS`](https://docs.cockroachlabs.com/docs/stable/show-grants) | List the privileges granted to users. |

## See also

* [Client Connection Parameters](https://docs.cockroachlabs.com/docs/stable/connection-parameters.md)
* [SQL Statements](https://docs.cockroachlabs.com/docs/stable/sql-statements.md)
* [`CREATE USER`](https://docs.cockroachlabs.com/docs/stable/create-user)
* [`ALTER USER`](https://docs.cockroachlabs.com/docs/stable/alter-user)
* [`DROP USER`](https://docs.cockroachlabs.com/docs/stable/drop-user)
* [`SHOW USERS`](https://docs.cockroachlabs.com/docs/stable/show-users)
* [`CREATE ROLE`](https://docs.cockroachlabs.com/docs/stable/create-role)
* [`ALTER ROLE`](https://docs.cockroachlabs.com/docs/stable/alter-role)
* [`DROP ROLE`](https://docs.cockroachlabs.com/docs/stable/drop-role)
* [`SHOW ROLES`](https://docs.cockroachlabs.com/docs/stable/show-roles)
* [`GRANT`](https://docs.cockroachlabs.com/docs/stable/grant)
* [`REVOKE`](https://docs.cockroachlabs.com/docs/stable/revoke)
* [`SHOW GRANTS`](https://docs.cockroachlabs.com/docs/stable/show-grants)