Manage Cluster User Authorization

This page documents procedures for managing the lifecycle of SQL users and roles on CockroachDB clusters.

Procedures for managing access are covered in .

The concept of Organization user is distinct from Authorization of SQL user/role on clusters is distinct from authorization of CockroachDB Cloud users within CockroachDB Cloud organizations.

Learn more: For reference documentation and explanation of related concepts, see .

Create CockroachDB users

Use the and statements to create and remove users, the statement to add or change a user’s password and role options, the and statements to manage the user’s privileges, and the statement to list users.

A new user must be granted the required privileges for each database and table that the user needs to access.

By default, a new user belongs to the public role and has no privileges other than those assigned to the public role.

Create and manage roles

For examples showing how to create and manage your cluster’s users and roles, see the following documentation:

Statement	Description
	Create SQL roles.
	Remove one or more SQL roles.
	Change passwords, role options, and default session variables for a role.
	Create SQL users.
	Remove one or more SQL users.
	Change passwords and role options for a user.
	Manage each role or user’s SQL privileges for interacting with specific databases and tables, or add a role or user as a member to a role.
	Revoke privileges from users and/or roles, or revoke a role or user’s membership to a role.
	List the roles for all databases.
	List the privileges granted to users.

See also