From 80d5b58b9b33b4e1449bbb3965d9cf32d3c192ca Mon Sep 17 00:00:00 2001 From: Chiziaruhoma Ogbonda Date: Thu, 24 Sep 2026 12:00:36 +0100 Subject: [PATCH 1/2] docs(cloud): describe db users as database users instead of superusers --- cloud_docs/concepts/database.md | 4 ++-- cloud_docs/reference/cli/commands/db/_db.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/cloud_docs/concepts/database.md b/cloud_docs/concepts/database.md index 72b36525..f97fd6fa 100644 --- a/cloud_docs/concepts/database.md +++ b/cloud_docs/concepts/database.md @@ -53,7 +53,7 @@ You can connect to the managed database from your machine, a GUI client, or `psq The steps: 1. Run `serverpod cloud db connection` to print the host, port, and database name. -2. Run `serverpod cloud db user create ` to create a superuser. The password is shown **once**, so save it. +2. Run `serverpod cloud db user create ` to create a database user. It can read and write data, but it can't create or change tables. The password is shown **once**, so save it. 3. Connect from your client with the host, port, database, your username, and the saved password. Both commands need to know which project you're working with. From a project directory that's been linked (any project created with `serverpod cloud launch` is linked automatically), the project ID is picked up from `scloud.yaml`. From anywhere else, pass `-p your-project-id`. @@ -87,7 +87,7 @@ The managed database is built so you don't have to think about credentials in yo - **TLS is required for all connections.** Cloud sets `SERVERPOD_DATABASE_REQUIRE_SSL` to `true` for your server, and the same applies to direct connections from `psql` or a GUI client. - **The server's password is managed by the platform.** It's never written into your repo and never shown to you. Your server reads it from the injected environment at runtime. -- **Direct access uses separate superusers that you create.** The server's user and the users you create with `serverpod cloud db user create` are distinct, so revoking or rotating a direct-access password does not affect the server. +- **Direct access uses separate database users that you create.** The server's user and the users you create with `serverpod cloud db user create` are distinct, so revoking or rotating a direct-access password does not affect the server. ## Performance diff --git a/cloud_docs/reference/cli/commands/db/_db.md b/cloud_docs/reference/cli/commands/db/_db.md index 2b9aeabe..83506df1 100644 --- a/cloud_docs/reference/cli/commands/db/_db.md +++ b/cloud_docs/reference/cli/commands/db/_db.md @@ -1,5 +1,5 @@ # scloud db -`scloud db` manages your project's database directly: print connection details, create and reset superusers for `psql` or GUI clients, and wipe the database during development. These operations are independent of how your server connects (the server's credentials are injected by Cloud separately). +`scloud db` manages your project's database directly: print connection details, create and reset database users for `psql` or GUI clients, and wipe the database during development. These operations are independent of how your server connects (the server's credentials are injected by Cloud separately). See [Database](/cloud/concepts/database) for the model, common operations, and security notes around direct access. From 8c4ba0961fed91cba85116b1dc8d0bb8b932dd6e Mon Sep 17 00:00:00 2001 From: Chiziaruhoma Ogbonda Date: Thu, 24 Sep 2026 14:12:56 +0100 Subject: [PATCH 2/2] docs(cloud): split the direct access sentence on the database page --- cloud_docs/concepts/database.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cloud_docs/concepts/database.md b/cloud_docs/concepts/database.md index f97fd6fa..527af7bb 100644 --- a/cloud_docs/concepts/database.md +++ b/cloud_docs/concepts/database.md @@ -87,7 +87,7 @@ The managed database is built so you don't have to think about credentials in yo - **TLS is required for all connections.** Cloud sets `SERVERPOD_DATABASE_REQUIRE_SSL` to `true` for your server, and the same applies to direct connections from `psql` or a GUI client. - **The server's password is managed by the platform.** It's never written into your repo and never shown to you. Your server reads it from the injected environment at runtime. -- **Direct access uses separate database users that you create.** The server's user and the users you create with `serverpod cloud db user create` are distinct, so revoking or rotating a direct-access password does not affect the server. +- **Direct access uses separate database users that you create.** The server connects as its own user, not as one you create with `serverpod cloud db user create`. Revoking or rotating a direct-access password doesn't affect the server. ## Performance