---
title: "Reset the database password or TLS certificate"
method: POST
path: "/v2/databases/{databaseId}/credentials/reset"
tags: ["Credentials"]
---

# Reset the database password or TLS certificate

`POST /v2/databases/{databaseId}/credentials/reset`

Rotates either the access password or the TLS certificate of the database. The database must be running.

Resetting `password` returns the new password once; resetting `certificate` returns success and the new certificate is fetched separately via `/credentials/certificate`.

Rate limited to 1 reset every 3 seconds per user.

## Path parameters

- `databaseId` string, required

## Request body

- object
  - `reset` 'certificate' | 'password', required

## Response `200`

Reset completed.

- object
  - `status` 'success', required
  - `response` object — Present when `reset: password`; absent when `reset: certificate`.
    - `password` string, required — Shown only once for password resets.

## Other responses

- `400` — Invalid reset type or the database is not running.
- `401` — The Authorization header is missing, malformed, or the credentials are not valid.
- `404` — The database does not exist or is not owned by the caller.
- `413` — The request body is larger than the maximum allowed size (100MB).
- `429` — The endpoint enforces its own rate limit and the caller hit the cooldown.
- `500` — The credential rotation was rejected.

---

[API](https://skmtc.dev/squarecloud/apis/square-cloud-api.md) · [All operations](https://skmtc.dev/squarecloud/apis/square-cloud-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/squarecloud/square-cloud-api/revisions/54b7733a6b95/schema)