---
title: "Reset a Database User's Password or Authentication Method"
method: POST
path: "/v2/databases/{database_cluster_uuid}/users/{username}/reset_auth"
tags: ["DigitalOcean-public.v2-new_Databases"]
---

# Reset a Database User's Password or Authentication Method

`POST /v2/databases/{database_cluster_uuid}/users/{username}/reset_auth`

To reset the password for a database user, send a POST request to
`/v2/databases/$DATABASE_ID/users/$USERNAME/reset_auth`.

For `mysql` databases, the authentication method can be specifying by
including a key in the JSON body called `mysql_settings` with the `auth_plugin`
value specified.

The response will be a JSON object with a `user` key. This will be set to an
object containing the standard database user attributes.

## Path parameters

- `database_cluster_uuid` string, uuid, required
- `username` string, required

## Request body

- object
  - `mysql_settings` MysqlSettings
    - `auth_plugin` 'mysql_native_password' | 'caching_sha2_password', required — A string specifying the authentication method to be used for connections to the MySQL user account. The valid values are `mysql_native_password` or `caching_sha2_password`. If excluded when creating a new user, the default for the version of MySQL in use will be used. As of MySQL 8.0, the default is `caching_sha2_password`.

## Response `200`

A JSON object with a key of `user`.

- object
  - `user` DatabaseUser, required
    - `name` string, required — The name of a database user.
    - `role` 'primary' | 'normal' — A string representing the database user's role. The value will be either "primary" or "normal".
    - `password` string — A randomly generated password for the database user.<br>Requires `database:view_credentials` scope.
    - `access_cert` string — Access certificate for TLS client authentication. (Kafka only)
    - `access_key` string — Access key for TLS client authentication. (Kafka only)
    - `mysql_settings` MysqlSettings
      - `auth_plugin` 'mysql_native_password' | 'caching_sha2_password', required — A string specifying the authentication method to be used for connections to the MySQL user account. The valid values are `mysql_native_password` or `caching_sha2_password`. If excluded when creating a new user, the default for the version of MySQL in use will be used. As of MySQL 8.0, the default is `caching_sha2_password`.
    - `settings` UserSettings
      - `pg_allow_replication` boolean — For Postgres clusters, set to `true` for a user with replication rights. This option is not currently supported for other database engines.
      - `opensearch_acl` object[] — ACLs (Access Control Lists) specifying permissions on index within a OpenSearch cluster.
        - `index` string — A regex for matching the indexes that this ACL should apply to.
        - `permission` 'deny' | 'admin' | 'read' | 'readwrite' | 'write' — Permission set applied to the ACL. 'read' allows user to read from the index. 'write' allows for user to write to the index. 'readwrite' allows for both 'read' and 'write' permission. 'deny'(default) restricts user from performing any operation over an index. 'admin' allows for 'readwrite' as well as any operations to administer the index.
      - `acl` object[] — ACLs (Access Control Lists) specifying permissions on topics within a Kafka cluster.
        - `id` string — An identifier for the ACL. Will be computed after the ACL is created/updated.
        - `topic` string, required — A regex for matching the topic(s) that this ACL should apply to.
        - `permission` 'admin' | 'consume' | 'produce' | 'produceconsume', required — Permission set applied to the ACL. 'consume' allows for messages to be consumed from the topic. 'produce' allows for messages to be published to the topic. 'produceconsume' allows for both 'consume' and 'produce' permission. 'admin' allows for 'produceconsume' as well as any operations to administer the topic (delete, update).
      - `mongo_user_settings` object — MongoDB-specific settings for the user. This option is not currently supported for other database engines.
        - `databases` string[] — A list of databases to which the user should have access. When the database is set to `admin`, the user will have access to all databases based on the user's role i.e. a user with the role `readOnly` assigned to the `admin` database will have read access to all databases.
        - `role` 'readOnly' | 'readWrite' | 'dbAdmin' — The role to assign to the user with each role mapping to a MongoDB built-in role. `readOnly` maps to a [read](https://www.mongodb.com/docs/manual/reference/built-in-roles/#mongodb-authrole-read) role. `readWrite` maps to a [readWrite](https://www.mongodb.com/docs/manual/reference/built-in-roles/#mongodb-authrole-readWrite) role. `dbAdmin` maps to a [dbAdmin](https://www.mongodb.com/docs/manual/reference/built-in-roles/#mongodb-authrole-dbAdmin) role.

## Other responses

- `401` — Authentication failed due to invalid credentials.
- `404` — The resource was not found.
- `429` — The API rate limit has been exceeded.
- `500` — There was a server error.
- `default` — There was an unexpected error.

## Changes

- **2025-10-16** `cb3bf9b21459` — 2 info
  - api tag `DigitalOcean-public.v2-new_Databases` added
  - api tag `Databases` removed
- **2025-07-18** `f8e8c290636c` — 1 info
  - endpoint added
- **2025-07-17** `5fc9af728e82` — 1 breaking
  - api path removed without deprecation
- **2025-07-17** `f8e8c290636c` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/digitalocean/apis/digitalocean-api/changes/v2/databases/:database_cluster_uuid/users/:username/reset_auth/post.md)

---

[API](https://skmtc.dev/digitalocean/apis/digitalocean-api.md) · [All operations](https://skmtc.dev/digitalocean/apis/digitalocean-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/digitalocean/digitalocean-api/revisions/cb3bf9b21459/schema)