Create an application role
Provision an application database identity during environment setup.
Neon · Command
neonctl roles create
Creates a PostgreSQL role in a Neon project from the command line. Provide a name and optionally select the branch, project, and whether the role can log in.
How it works
The command creates a PostgreSQL role in a Neon project. Supply the role name, and optionally choose a branch and project; adding --no-login creates a role that cannot log in.
Syntax
neon roles create [options]Parameters
| Name | Type | Description |
|---|---|---|
--name | string | Role name; required. |
--no-login | boolean | Create a role that cannot log in; optional. |
--branch | string | Branch ID or name; optional. |
--project-id | string | Project ID; optional. |
Returns
Displays the created role, including its name and creation timestamp.
Key points
- The subcommand creates a PostgreSQL role.
- Use --branch with either a branch identifier or branch name.
- The documented command signature places options after the create subcommand.
Common mistakes
- Keep the role name within PostgreSQL's 63-byte limit.
- Use --no-login only when the role should be unable to authenticate.
Example: Create a role
neon roles create --name app_user --branch main --project-id "$NEON_PROJECT_ID"Creates the app_user role on the specified branch.
When to use it
Create a non-login role
Create a role intended for ownership or grants rather than authentication.
Target a branch
Automate role creation for a selected Neon branch.
Interview questions
QHow do you create a role with the Neon CLI?
Use neon roles create with the required --name option. The command can also receive --branch and --project-id to target a particular branch and project.
Follow-up: What restriction applies to the name? It must not exceed 63 bytes.
QHow do you create a passwordless role?
Add --no-login. This creates a role that cannot log in, which is suitable for roles intended only to own database objects or receive permissions.
Follow-up: What is the alternative when the role must authenticate? Omit --no-login and create a normal login-capable role.
QHow do you target a specific branch and project?
The command accepts --branch as a branch ID or name and --project-id as the project identifier. Both are optional in the documented signature.
Follow-up: Why specify them explicitly? They make the target unambiguous when the current CLI context is not the intended project or branch.
Related
neon rolesneon roles listneon roles delete