Skip to content
masterclassBuddyTech Buzz5 fresh blogs · 5:00 AM IST
Start learning

Neon · Const

Protected branches

Neon protected branches safeguard production or sensitive data by blocking destructive branch, compute, and project operations. They can also trigger fresh child-branch credentials and optionally restrict access through IP Allow.

How it works

A protected branch is a Neon branch designated for production or other sensitive data. Neon prevents destructive branch, compute, and project operations, generates fresh Postgres role passwords for child branches, and can optionally limit network access to protected branches with IP Allow.

Syntax

neonctl branches create --project-id <project-id> --name <branch-name> --protected

Key points

  • Any Neon branch can be assigned protected status to activate the feature.
  • Deletion of the protected branch itself is blocked.
  • Resetting a protected branch is blocked, preserving its branch state.
  • A project containing a protected branch cannot be removed.
  • The compute associated with a protected branch is also protected from deletion.
  • Automatic inactivity-based archiving does not apply to protected branches.

Common mistakes

  • Protected branches require a paid Neon plan; availability and limits depend on the plan.
  • Child branches receive newly generated Postgres role passwords, so credentials from the protected parent are not reused.
  • IP restrictions are not automatic; configure IP Allow and select the protected-branches-only scope.

Example: Create a protected branch

neonctl branches create --project-id "$NEON_PROJECT_ID" --name production --protected

Creates a protected production branch with the Neon CLI; authenticate and configure neonctl before running it.

When to use it

Prevent accidental production deletion or reset

Production database branch

Keep important data from inactivity archiving

Sensitive-data branch

Avoid inheriting protected-branch credentials

Developer or preview branches

Apply IP Allow rules only to protected branches

Restricted production network

Interview questions

QWhat protections does a protected branch provide?

A protected branch cannot be deleted or reset, and its project cannot be deleted. The compute attached to it also cannot be deleted, and inactivity does not archive the branch.

Follow-up: How can access be limited to these branches? Configure Neon IP Allow and apply the allowlist only to protected branches.

QWhat happens to Postgres role passwords on child branches?

When a branch is created from a protected branch, Neon automatically generates new passwords for Postgres roles on the child branch. This prevents credentials from the protected branch from carrying over.

Follow-up: Does protection itself restrict network access? No; IP Allow requires separate configuration.

QWho can use protected branches, and what are the documented plan limits?

Protected branches are available on Neon paid plans. The guide lists up to two protected branches for Launch and up to five for Scale.

Follow-up: What should determine which branch is protected? Normally select branches containing production or sensitive data.

  • IP Allow
  • branch archiving
  • Postgres roles
  • reset a branch from parent
  • Neon paid plans

Source: Protected branches - Neon Docs. Checked 2026-10-16.