CREATE_ROLE(7)

CREATE ROLE(7) — the glow-up guide 💅

okay bestie, gather round, because we're about to talk about the PostgreSQL 18.6 Documentation page for CREATE ROLE, and honestly? it's giving iconic. this is the command that makes whole new roles (aka users, aka groups, aka both, we'll get there) in your cluster. let's go 🦋

---

✨ NAME ✨

CREATE_ROLE — define a new database role. that's it, that's the name, periodt 💖

---

✨ SYNOPSIS ✨

CREATE ROLE name [ [ WITH ] option [ ... ] ]

where option can be:

      SUPERUSER | NOSUPERUSER
    | CREATEDB | NOCREATEDB
    | CREATEROLE | NOCREATEROLE
    | INHERIT | NOINHERIT
    | LOGIN | NOLOGIN
    | REPLICATION | NOREPLICATION
    | BYPASSRLS | NOBYPASSRLS
    | CONNECTION LIMIT connlimit
    | [ ENCRYPTED ] PASSWORD 'password' | PASSWORD NULL
    | VALID UNTIL 'timestamp'
    | IN ROLE role_name [, ...]
    | ROLE role_name [, ...]
    | ADMIN role_name [, ...]
    | SYSID uid

look at all those options. a whole buffet. we're gonna go through every single one, no skips, no shortcuts, because i love you and i want you to actually understand this 💜

---

✨ DESCRIPTION ✨

So. CREATE ROLE adds a brand new role to a PostgreSQL database cluster. and a role? a role is an entity that can own database objects and have database privileges. it's lowkey a shapeshifter: a role can be considered a "user", a "group", or both, depending on how it is used. main character energy, honestly 👑

if you wanna read more about managing users and authentication, go check out Chapter 21 and Chapter 20. they're the deep lore.

🚨 okay important: you must have CREATEROLE privilege or be a database superuser to use this command. no CREATEROLE, no vibes.

and here's a thing people constantly get wrong: roles are defined at the database cluster level, which means they're valid in all databases in the cluster. not per-database. cluster-wide. fr fr.

when you're creating a role, you can also immediately do some membership magic: assign the newly created role to be a member of an existing role, and assign existing roles to be members of the newly created role. the rules for which initial role membership options end up enabled are described below in the IN ROLE, ROLE, and ADMIN clauses. (they're coming, i promise 🫶) and if you want fine-grained option control during membership creation, plus the ability to change those options later after the new role exists, that's the GRANT(7) command's whole thing.

---

✨ PARAMETERS ✨

the name

• name — the name of the new role. simple. beautiful. name your child 🎀

superuser stuff

• SUPERUSER, NOSUPERUSER — these clauses decide whether the new role is a "superuser", who can override all access restrictions within the database. superuser status is dangerous and should be used only when really needed. also, you must yourself be a superuser to create a new superuser — you can't hand out a crown you don't own 👑. if you don't specify anything, NOSUPERUSER is the default.

can it make databases?

• CREATEDB, NOCREATEDB — these clauses define a role's ability to create databases. specify CREATEDB and the role being defined will be allowed to create new databases. specify NOCREATEDB and you're denying a role the ability to create databases. if not specified, NOCREATEDB is the default. also, only superuser roles or roles with CREATEDB can specify CREATEDB. gatekeeping, but make it permissions 💅

can it make roles?

• CREATEROLE, NOCREATEROLE — these clauses determine whether a role will be permitted to create, alter, drop, comment on, and change the security label for other roles. (see role creation for more details about what capabilities this privilege actually confers.) if not specified, NOCREATEROLE is the default.

the inheritance drama

• INHERIT, NOINHERIT — this affects the membership inheritance status when this role is added as a member of another role, both in this and future commands. specifically, it controls the inheritance status of memberships added with this command using the IN ROLE clause, and in later commands using the ROLE clause. it's also used as the default inheritance status when adding this role as a member using the GRANT command. if not specified, INHERIT is the default.

and a lil history lesson 🕰️: in PostgreSQL versions before 16, inheritance was a role-level attribute that controlled all runtime membership checks for that role. we've evolved, bestie.

login or no login

• LOGIN, NOLOGIN — these clauses determine whether a role is allowed to log in; that is, whether the role can be given as the initial session authorization name during client connection. a role having the LOGIN attribute can be thought of as a user. roles without this attribute are useful for managing database privileges, but are not users in the usual sense of the word. if not specified, NOLOGIN is the default — except when CREATE ROLE is invoked through its alternative spelling CREATE USER. sneaky lil exception, iykyk 🙈

replication zone

• REPLICATION, NOREPLICATION — these clauses determine whether a role is a replication role. a role must have this attribute (or be a superuser) in order to be able to connect to the server in replication mode (physical or logical replication), and in order to be able to create or drop replication slots. a role having the REPLICATION attribute is a very highly privileged role, and should only be used on roles actually used for replication. if not specified, NOREPLICATION is the default. and only superuser roles or roles with REPLICATION can specify REPLICATION. 💀 big deal energy

row-level security bypass

• BYPASSRLS, NOBYPASSRLS — these clauses determine whether a role bypasses every row-level security (RLS) policy. NOBYPASSRLS is the default. only superuser roles or roles with BYPASSRLS can specify BYPASSRLS.

also a note: pg_dump will set row_security to OFF by default, to ensure all contents of a table are dumped out. if the user running pg_dump does not have appropriate permissions, an error will be returned. however, superusers and the owner of the table being dumped always bypass RLS. so, like, it works out ✨

connection limit

• CONNECTION LIMIT connlimit — if the role can log in, this specifies how many concurrent connections the role can make. -1 (the default) means no limit. note that only normal connections are counted towards this limit. neither prepared transactions nor background worker connections are counted towards this limit. so don't stress about the invisible ones 🌸

passwords

• [ ENCRYPTED ] PASSWORD 'password', PASSWORD NULL — sets the role's password. (a password is only of use for roles having the LOGIN attribute, but you can nonetheless define one for roles without it. no rules, just vibes.) if you do not plan to use password authentication you can omit this option. if no password is specified, the password will be set to null and password authentication will always fail for that user. a null password can optionally be written explicitly as PASSWORD NULL.

Note: specifying an empty string will also set the password to null, but that was not the case before PostgreSQL version 10. in earlier versions, an empty string could be used, or not, depending on the authentication method and the exact version, and libpq would refuse to use it in any case. to avoid the ambiguity, specifying an empty string should be avoided. just... don't. okay? okay 💖

the password is always stored encrypted in the system catalogs. the ENCRYPTED keyword has no effect, but is accepted for backwards compatibility (it's just there to be polite). the method of encryption is determined by the configuration parameter password_encryption. if the presented password string is already in MD5-encrypted or SCRAM-encrypted format, then it is stored as-is regardless of password_encryption (since the system cannot decrypt the specified encrypted password string, to encrypt it in a different format). this allows reloading of encrypted passwords during dump/restore. very practical, very demure 🎀

Warning: support for MD5-encrypted passwords is deprecated and will be removed in a future release of PostgreSQL. refer to Section 20.5 for details about migrating to another password type. do not build your whole life on MD5, bestie 😭

expiry

• VALID UNTIL 'timestamp' — the VALID UNTIL clause sets a date and time after which the role's password is no longer valid. if this clause is omitted the password will be valid for all time. immortal password. iconic.

adding the new role INTO other roles

• IN ROLE role_name — the IN ROLE clause causes the new role to be automatically added as a member of the specified existing roles. the new membership will have the SET option enabled and the ADMIN option disabled. the INHERIT option will be enabled unless the NOINHERIT option is specified.

making the new role a group

• ROLE role_name — the ROLE clause causes one or more specified existing roles to be automatically added as members, with the SET option enabled. this in effect makes the new role a "group". roles named in this clause with the role-level INHERIT attribute will have the INHERIT option enabled in the new membership. new memberships will have the ADMIN option disabled.

admin powers

• ADMIN role_name — the ADMIN clause has the same effect as ROLE, but the named roles are added as members of the new role with ADMIN enabled, giving them the right to grant membership in the new role to others. handing out the keys to the group chat 🔑

the fossil

• SYSID uid — the SYSID clause is ignored, but is accepted for backwards compatibility. it's a ghost. it's there, it does nothing, we respect it 🫡

---

✨ NOTES ✨

use ALTER ROLE to change the attributes of a role, and DROP ROLE to remove a role. and good news: all the attributes specified by CREATE ROLE can be modified by later ALTER ROLE commands. nothing is forever, you can always pivot 💅

the preferred way to add and remove members of roles that are being used as groups is to use GRANT and REVOKE. that's the blessed path 🛤️

the VALID UNTIL clause defines an expiration time for a password only, not for the role per se. in particular, the expiration time is not enforced when logging in using a non-password-based authentication method. so if you're logging in some other way, that timestamp is just decorative 🎀

the role attributes defined here are non-inheritable, i.e., being a member of a role with, e.g., CREATEDB will not allow the member to create new databases even if the membership grant has the INHERIT option. of course, if the membership grant has the SET option the member role would be able to SET ROLE to the createdb role and then create a new database. so like, it's not that you can't, it's that you have to step into it first 💃

the membership grants created by the IN ROLE, ROLE, and ADMIN clauses have the role executing this command as the grantor. you did it, so it's your name on it ✨

the INHERIT attribute is the default for reasons of backwards compatibility: in prior releases of PostgreSQL, users always had access to all privileges of groups they were members of. however, NOINHERIT provides a closer match to the semantics specified in the SQL standard. so, like, the default is the old-school one and the standards-compliant one is the other one. make of that what you will 🙃

PostgreSQL includes a program createuser(1) that has the same functionality as CREATE ROLE (in fact, it calls this command) but can be run from the command shell. it's the same girl, different outfit 👑

the CONNECTION LIMIT option is only enforced approximately; if two new sessions start at about the same time when just one connection "slot" remains for the role, it is possible that both will fail. also, the limit is never enforced for superusers. rules for thee, not for the superuser 💀

caution must be exercised when specifying an unencrypted password with this command. the password will be transmitted to the server in cleartext, and it might also be logged in the client's command history or the server log. the command createuser(1), however, transmits the password encrypted. also, psql(1) contains a command \password that can be used to safely change the password later. so like, please, for the love of everything, don't paste your plaintext password into a shell where it'll live forever 😭

---

and that's where part 1 wraps, but we are so not done — part 2 is right behind me, keep scrolling bestie 💖

💖 EXAMPLES 💖

okay bestie, this is the part where we actually do the thing. let's go 🎀

---

Make a role that can log in, but don't hand it a password at all:

CREATE ROLE jonathan LOGIN;

like, it can walk through the door, it just doesn't have a key yet. iconic.

---

Make a role with a password:

CREATE USER davide WITH PASSWORD 'jw8s0F4';

and just so we're clear — CREATE USER is literally the same as CREATE ROLE except that it implies LOGIN. that's the whole difference. periodt. ✨

---

Make a role whose password expires at the end of 2004:

CREATE ROLE miriam WITH LOGIN PASSWORD 'jw8s0F4' VALID UNTIL '2005-01-01';

the second that one second ticks over into 2005, that password is no longer valid. expired. gone. it's giving "cinderella at midnight" 🕛😭

---

Make a role that can create databases AND manage other roles:

CREATE ROLE admin WITH CREATEDB CREATEROLE;

main character energy fr fr 👑

---

🌈 COMPATIBILITY 🌈

so like, CREATE ROLE is in the SQL standard. but the standard is doing the absolute bare minimum, bestie — it only requires this syntax:

CREATE ROLE name [ WITH ADMIN role_name ]

multiple initial administrators? all the other options of CREATE ROLE? yeah those are PostgreSQL extensions. the standard did not come with those. we added them. 💅

---

ngl the SQL standard is a little confused about users vs roles. it defines both concepts, but it treats them as distinct things, and it leaves every command that defines users to be specified by each individual database implementation. in PostgreSQL we chose to unify users and roles into a single kind of entity. so like, roles here just have way more optional attributes than they do in the standard. slay. 🌸

---

so if you want the closest possible vibe to what the standard specifies, here's the tea:

• SQL-standard users → make them as PostgreSQL roles with the NOINHERIT option
• SQL-standard roles → make them as PostgreSQL roles with the INHERIT option

that's the approximation, bestie. remember it. 🫶

---

and now, the deprecated section, aka the "we still support it but please don't" corner 🙈

the USER clause behaves exactly the same as ROLE, but it's been deprecated:

USER role_name [, ...]

and the IN GROUP clause behaves exactly the same as IN ROLE, but it's also been deprecated:

IN GROUP role_name [, ...]

⚠️ both of these are deprecated!! they still work, but like… don't start anything new with them. use ROLE and IN ROLE instead. no cap.

---

🦋 SEE ALSO 🦋

go read these next, bestie, they're all part of the same saga 💜

• SET ROLE (SET_ROLE(7))
• ALTER ROLE (ALTER_ROLE(7))
• DROP ROLE (DROP_ROLE(7))
• GRANT(7)
• REVOKE(7)
• createuser(1)
• createrole_self_grant

---

and that's the whole page, bestie!! you ate that 💅✨

this lil masterpiece is from PostgreSQL 18.6, dated 2026, and it lives under the name CREATE ROLE(7). go forth and make roles responsibly, mwah 💖🎀🦋