pg token

runlot pg token

Issued short-lived credentials for me/my-app (valid until 2026-09-05T15:02:11Z).
postgresql://u_a1b2c3:…@my-app--me.wire.runlot.app:5433/my-app?sslmode=require
The password is shown this one time only. To revoke it, run `runlot pg token revoke u_a1b2c3`.

The default lifetime is 1 hour.

runlot pg token --ttl 30m
runlot pg token --ttl 7d
runlot pg token --json

--ttl takes a number together with a unit (30m, 1h, 7d). A bare number without a unit is not accepted, and the minimum lifetime is one minute.

The password is shown only once

After it is issued, not even runlot can read the password again. The control plane stores only the SCRAM verifier and discards the plaintext password. If you lose the password, issue new credentials and then revoke the old ones.

Listing and revoking

runlot pg token list

user        expiresAt                 createdAt
u_a1b2c3    2026-09-05T15:02:11Z      2026-09-05T14:02:11Z

runlot pg token revoke u_a1b2c3

Revoked credentials stop working immediately.

When to use it

• External BI tools or dashboards
• An app running on another hosting environment that needs to read this database
• Checking the schema from CI

When a person connects directly from their own machine, we recommend port-forward instead. You do not have to create a separate password, and once the login session ends the connection is no longer allowed.