For AI agents: The documentation index is at https://docs.digitalocean.com/llms.txt. Markdown versions of pages use the same URL with index.html.md in place of the HTML page (for example, append index.html.md to the directory path instead of opening the HTML document).

MongoDB database clusters come configured with a default database (admin), a default administrative user (doadmin), and a default read-only user (do-readonly). These defaults are necessary for cluster replication and administration, so you can’t delete them, but you can add additional users and databases.

By default, every database cluster is publicly accessible. To natively limit access, you can add trusted sources.

You cannot add users to a cluster using the mongosh shell. Users must be added to the cluster using the DigitalOcean Control Panel, API, or CLI.

When you add a user using the API, set the user’s role in settings.mongo_user_settings.role to dbAdmin, readWrite, or readOnly, and list the databases the user can access in settings.mongo_user_settings.databases.

You cannot change a MongoDB user’s role or database access after you create the user. To apply different permissions, delete the user and create a new one.

Manage Database Users Using Automation

You can manage database users using the DigitalOcean CLI (doctl) or the API.

Create or Delete a Database User via CLI

Create or Delete a Database User via API

curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $DIGITALOCEAN_TOKEN" \
  -d '{"name": "app-01"}' \
  "https://api.digitalocean.com/v2/databases/9cc10173-e9ea-4176-9dbc-a4cee4c4ff30/users"

import (
    "context"
    "os"

    "github.com/digitalocean/godo"
)

func main() {
    token := os.Getenv("DIGITALOCEAN_TOKEN")

    client := godo.NewFromToken(token)
    ctx := context.TODO()

    addUserRequest := &godo.DatabaseCreateUserRequest{
        Name: "app-01",
    }

    user, _, err := client.Databases.CreateUser(ctx, "88055188-9e54-4f21-ab11-8a918ed79ee2", addUserRequest)

}

import os
from pydo import Client

client = Client(token=os.environ.get("DIGITALOCEAN_TOKEN"))

add_user_resp = client.databases.add_user(database_cluster_uuid="ab7bb7a", body={"name": "app-01"})

curl -X DELETE \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $DIGITALOCEAN_TOKEN" \
  "https://api.digitalocean.com/v2/databases/9cc10173-e9ea-4176-9dbc-a4cee4c4ff30/users/app-01"

import (
    "context"
    "os"

    "github.com/digitalocean/godo"
)

func main() {
    token := os.Getenv("DIGITALOCEAN_TOKEN")

    client := godo.NewFromToken(token)
    ctx := context.TODO()

    _, err := client.Databases.DeleteUser(ctx, "9cc10173-e9ea-4176-9dbc-a4cee4c4ff30", "app-01")
}

import os
from pydo import Client

client = Client(token=os.environ.get("DIGITALOCEAN_TOKEN"))

delete_resp = client.databases.delete_user(database_cluster_uuid="aba134a", username="backend_user1")

Add or Delete a Database User Using the Control Panel

To add or delete users or databases to a database cluster, click the name of the database to go to its Overview page, then select the Users & Databases tab.

Create new users in the Users section by entering a name in the Add new user field and clicking Save. The new user receives a password that you can view temporarily. Copy the password and store it safely.

New users receive the permissions of the doadmin user by default, and you can’t choose a different role in the control panel. To create a user with the dbAdmin, readWrite, or readOnly role, add the user using the API.

You can also delete a user here by opening the user’s More menu, clicking Delete, and then confirming the deletion. Similarly, to reset a user’s password, open the user’s More menu and select Reset password. If you have any services that depend on that user’s credentials, such as log forwarding, resetting the password may break that service.

Create a new database in the Databases section by entering a name in the Add new database field and clicking Save. You can also delete a database here by opening its More menu, clicking Delete, and then confirming the deletion.