Protect production data from destructive branch operations
Production database
Neon · Const
Branch protection
Neon branch protection safeguards critical branches such as production from deletion, reset, project deletion, compute deletion, and inactivity archiving. It also generates fresh Postgres role passwords for child branches and can work with IP Allow restrictions.
How it works
Branch protection marks a Neon branch as protected so critical data is guarded against destructive lifecycle operations. It also protects related project and compute resources, generates fresh Postgres role passwords for child branches, and can be combined with IP Allow restrictions.
Syntax
neon api /projects/{project_id}/branches/{branch_id} -X PATCH -F branch.protected=trueKey points
- Protection blocks deletion of the protected branch itself.
- A project containing a protected branch is also protected from deletion.
- The compute resources attached to a protected branch cannot be removed.
- Child branches receive newly generated Postgres role passwords instead of inheriting the source credentials.
- IP Allow can be configured so network restrictions apply specifically to protected branches.
- Production and other sensitive-data branches are the primary candidates for protection.
Common mistakes
- A protected branch must be unprotected before it can be deleted.
- Resetting a protected branch is blocked until protection is removed.
- Branch protection requires a paid Neon plan.
- Automatic inactivity archiving does not apply to protected branches.
Example: Protect a branch with the CLI
neon api /projects/dry-heart-13671059/branches/br-curly-wave-123456 -X PATCH -F branch.protected=trueUses the Neon CLI API passthrough to mark the specified branch as protected.
When to use it
Give child branches fresh role passwords
Credential isolation
Limit protected-branch connections with IP Allow
Network security
Guard sensitive non-production branches
Critical staging environment
Interview questions
QWhat operations does branch protection prevent?
Branch protection prevents deletion and reset of the branch, and it also prevents deletion of the project and computes associated with that branch. It is intended for critical branches such as production.
Follow-up: How can network access be restricted as well? Configure IP Allow and apply the restriction to protected branches only.
QWhat happens to Postgres role passwords on child branches?
When a child branch is created from a protected branch, Neon automatically generates new passwords for PostgreSQL roles. This helps prevent credentials from leaking from the protected source branch into its children.
Follow-up: What protection remains if a child branch is later created from that child? The newly created branch again receives automatically generated role passwords because its parent is protected.
QHow do you enable branch protection?
Protection is enabled in the Console by selecting a project, opening Branches, selecting a branch, choosing Protect or Set as protected, and confirming. The CLI has no dedicated protection command, so the API passthrough can update the branch's protected field.
Follow-up: What is the API field type? The branch update API defines protected as an optional boolean.
Related
IP AllowBranchesbranch archivingPostgres role passwords