Database passwords

#We never keep your password

A database's admin password is applied to the database and then forgotten. It is never stored in plain text, never shown in the console, never in a log, and no read of the database or its order includes it. Support cannot recover it either.

A generated password is shown exactly once, in the response that generated it, sent with Cache-Control: no-store. A password you choose is never returned at all.

So: keep it in your own secret store the moment you have it. If it is lost, reset it.

#The rules

A password you choose must be:

• 16 to 128 characters,
• printable ASCII only,
• with no spaces, quotes (' or ") or backslashes.

Those are the characters that break connection strings and shell commands. A generated password is 32 letters and digits.

#Set it at create

When you create a database, either:

• send password to choose it, or
• leave it out, and the generated one comes back in that response's password, with password_returned: true.

Until the database is being built, a password you sent is held only encrypted, and it is erased the moment it is handed to the database.

#Change it

In the console, the database's Admin password card has Change to set a password you choose and Reset to have one generated and shown once.

With the API, set a password you choose:

$ curl -X PUT https://api.pantechdynamics.com/public/v1/databases/db_…/password \    -H "Authorization: Bearer $PANTECH_API_KEY" \    -H "Idempotency-Key: $(uuidgen)" \    -H "Content-Type: application/json" \    -d '{"password": "…"}'

The database must be running (409 DATABASE_NOT_RUNNING otherwise). Follow the returned operation: the new password works once it has succeeded. Connections already open stay open.

#Reset it

Have a new password generated:

$ curl -X POST https://api.pantechdynamics.com/public/v1/databases/db_…/reset-password \    -H "Authorization: Bearer $PANTECH_API_KEY" \    -H "Idempotency-Key: $(uuidgen)"

{
  "operation_id": "op_…",
  "resource_id": "db_…",
  "status": "submitting",
  "password_returned": true,
  "password": "q8Vn3TzK1mXw7RbLc4Hs9JdP2fYa6GeU"
}

The new password is in this response only. It takes effect when the operation has succeeded.

#With the CLI

The CLI never takes a password as an argument, where it would land in your shell history:

$ pantech db password set orders-db --password-stdin < new-password.txt$ pantech db password reset orders-db

reset prints the new password once, alone on stdout, so pantech db password reset orders-db > pw.txt captures just it.

#From infrastructure as code

Tools that keep state, like Terraform, should never write the password into it. The Terraform pantechdynamics_database resource takes it as a write-only attribute, password_wo, which Terraform 1.11 and later never saves. Raise password_wo_version to set a new one:

resource "pantechdynamics_database" "orders" {
  # …
  password_wo         = var.orders_db_password
  password_wo_version = 2 # was 1: apply sends the new password
}

#If it goes wrong