Create a read-only application role
An application should query data without modifying it.
Neon · Const
Database roles
Neon database roles are branch-scoped PostgreSQL roles used as login users or privilege groups. Roles created through Neon management interfaces receive neon_superuser membership; SQL-created roles require explicit permission grants.
How it works
Neon uses PostgreSQL roles to represent users or groups and scopes them to individual branches. Roles created through the Console, CLI, or API receive neon_superuser membership, while SQL-created roles start with basic public-schema privileges and require explicit grants for the access they need.
Syntax
CREATE ROLE role_name [ [ WITH ] option [ ... ] ]Returns
A PostgreSQL role with branch-scoped identity and assigned attributes, memberships, and object privileges.
Key points
- Neon uses PostgreSQL's role system rather than a separate identity model.
- A new project receives a default role whose name is based on its database name.
- The default role owns the initial database on the project's default branch.
- Use login roles for accounts and group roles to bundle shared privileges.
Common mistakes
- Neon does not provide the ordinary PostgreSQL superuser account; use the neon_superuser role instead.
- Roles are branch-scoped, so create or manage the role in the branch where it is needed.
Example: Create a read-only database role
CREATE ROLE app_reader LOGIN PASSWORD 'replace-with-a-secure-password';
GRANT CONNECT ON DATABASE neondb TO app_reader;
GRANT USAGE ON SCHEMA public TO app_reader;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO app_reader;Creates a login role and grants it read access to the public schema of neondb. Use a securely generated password in real applications.
When to use it
Use a group role for shared access
Several accounts need the same permissions.
Manage branch-specific roles
A child branch needs isolated database identities.
Create roles through the CLI or API
An administrator needs to provision roles from automation.
Interview questions
QWhat is a Neon database role?
Neon implements database users and groups as PostgreSQL roles. A role may log in as a user or contain other roles as a group, and its privileges come from role attributes and grants.
Follow-up: How would you model application access? Create separate least-privilege roles, grant only the required object privileges, and assign those roles to login users.
QHow do Neon-created and SQL-created roles differ?
Roles created through the Neon Console, CLI, or API are members of neon_superuser and receive capabilities such as creating databases and roles. Roles created with SQL do not receive that membership automatically.
Follow-up: Why prefer SQL-created roles for applications? They begin with fewer privileges, making explicit least-privilege grants easier to enforce.
QWhat is the scope and limit of roles in Neon?
Roles are scoped to a branch, and Neon limits each branch to 500 roles. The default project role is named after the database and owns the database on the default branch.
Follow-up: What should be checked when a role is missing? Verify that the connection targets the intended branch, because a role in another branch is a different branch-scoped role.
Related
neon_superuserManage database accessneon rolesGRANTCREATE ROLERow-Level Security