PostgreSQL dynamic secrets

Updated September 19, 2026

Default statements (edit the GRANT):

CREATE USER "{{username}}" WITH ENCRYPTED PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';
GRANT CONNECT ON DATABASE "{{database}}" TO "{{username}}";

Revoke:

REASSIGN OWNED BY "{{username}}" TO CURRENT_USER;
DROP OWNED BY "{{username}}";
DROP ROLE "{{username}}";

Renew:

ALTER ROLE "{{username}}" VALID UNTIL '{{expiration}}';

Connection fields: host, port (5432), admin user, password, database, Require TLS. Local Postgres often has SSL off; uncheck Require TLS or the connector fails with server refused TLS connection. The connector uses pgx. Tokens in statements: {{username}}, {{password}}, {{expiration}}, {{database}}.