# How to create and manage database users

Create additional MySQL users with only the access they need - for example a read-only user
for reporting, or a separate user per application. Your application already has a main database user;
add extra users rather than sharing it.

## The TurboStack way: extra database users

The simplest option is to let TurboStack manage the user for you:

1. Open the application's **Configure application** dialog and go to the **Database Info** tab
   ([Applications](../../platform/hosts/applications/index.md)).
2. Add an **extra database user** and choose its role - **read-only** or **admin**.
3. Publish the host. TurboStack creates the user and shows its credentials on the
   [Credentials](../../platform/hosts/credentials.md) tab.

Use this for the common cases; it keeps the user in your configuration and recreates it consistently.

## Create a user by hand (SQL)

For finer-grained grants, connect over [SSH](../../platform/hosts/ssh.md) as your system user and run
SQL with the `mysql` command-line client (`mysql` is the client command, not a user name). Grant only
what the user needs.

A read-only user on one database:

```sql
CREATE USER 'prod_readonly'@'localhost' IDENTIFIED BY 'a-strong-password';
GRANT SELECT ON prod_db.* TO 'prod_readonly'@'localhost';
FLUSH PRIVILEGES;
```

A user with full access to a single application database:

```sql
CREATE USER 'prod_app'@'localhost' IDENTIFIED BY 'a-strong-password';
GRANT ALL PRIVILEGES ON prod_db.* TO 'prod_app'@'localhost';
FLUSH PRIVILEGES;
```

> [!TIP]
> Grant per database (`prod_db.*`), not globally (`*.*`). Never grant `ALL PRIVILEGES ON *.*` or
> `WITH GRANT OPTION` to an application user.

## Rotate a password

```sql
ALTER USER 'prod_readonly'@'localhost' IDENTIFIED BY 'a-new-strong-password';
FLUSH PRIVILEGES;
```

Update the password wherever the user is configured (the application, or your client) at the same time.

## Verify access

```sql
SHOW GRANTS FOR 'prod_readonly'@'localhost';
```

Then connect as that user and confirm it can do what it should - and nothing more.

## Related

- [Configure MySQL](configure.md)
- [Import and export a MySQL database](import-export-database.md)
- [Connect to your database remotely](connect-remotely.md)
- [Credentials](../../platform/hosts/credentials.md)
- [Applications](../../platform/hosts/applications/index.md)
</content>