# Users & Authentication

TypeDB requires authentication for all client connections. Understanding how authentication works across different deployments and how to manage users programmatically is essential for building secure applications.

## [](#_authentication_fundamentals)Authentication fundamentals

### [](#_required_credentials)Required credentials

Every TypeDB driver connection requires valid user credentials:

*   **Username**: The name of a TypeDB user
    
*   **Password**: The corresponding password for that user
    

```python
#!test
#{{
from typedb.driver import *
#}}
from typedb.driver import Credentials

# All connections require valid credentials
credentials = Credentials("admin", "password")

#{{
address = "localhost:1729"
options = DriverOptions(DriverTlsConfig.disabled())
#}}

driver = TypeDB.driver(address, credentials, options)
```

### [](#_default_users)Default users

TypeDB installations come with a default administrative user:

*   **Username**: `admin`
    
*   **Cloud password**: Set during cluster creation
    
*   **Community Edition / Enterprise default password**: `password`
    

Always change default passwords before deploying to production environments.

## [](#_http_endpoint_authentication)HTTP endpoint authentication

The HTTP endpoint uses token-based authentication instead of direct credentials.

Note that if you are using an official [TypeDB HTTP Driver](../../../reference/typedb-http-drivers/index.md), this process is handled by the library.

For the full reference, see the [TypeDB HTTP API](../../../reference/typedb-http-api/index.md) documentation.

### [](#_token_acquisition)Token acquisition

First, exchange your credentials for a temporary token:

```bash
curl --request POST \
  --url http://localhost:8000/v1/signin \
  --json '{"username": "admin", "password": "password"}'
```

Response:

```json
{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}
```

### [](#_using_tokens)Using tokens

Include the token in the Authorization header for subsequent requests:

```bash
curl --request GET \
  --url http://localhost:8000/v1/databases \
  --header 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...'
```

### [](#_token_lifecycle)Token lifecycle

*   **Expiration**: Tokens expire after a configurable period (default: 30 minutes)
    
*   **Renewal**: Obtain new tokens by re-authenticating
    
*   **Revocation**: Tokens are invalidated when servers restart
    

## [](#_updating_passwords)Updating passwords

It’s possible to change user passwords programmatically. The `admin` user can also be used to update any user’s password, all other users can only update their own password.

Python

```python
#!test[reset-after]
from typedb.driver import *

DB_NAME = "my_database"
address = "localhost:1729"
credentials = Credentials("admin", "password")
options = DriverOptions(DriverTlsConfig.disabled())

with TypeDB.driver(address, credentials, options) as driver:
    driver.users.create("demo_user", "test_password")

user_credentials = Credentials("demo_user", "test_password")
with TypeDB.driver(address, user_credentials, options) as driver:
    driver.users.get_current().update_password("password")
    print("Demo user updated password successfully")

with TypeDB.driver(address, credentials, options) as driver:
    driver.users.get("demo_user").update_password("externally_set_password")
    print("Admin updated demo user's password successfully")
```

## [](#_security_considerations)Security considerations

*   **Enable encryption** for all production deployments
    
*   **Use TLS certificates** from trusted Certificate Authorities
    
*   **Avoid plain-text connections** over untrusted networks
    
*   **Configure firewalls** to restrict database access
    

## [](#_authentication_errors)Authentication errors

Common authentication errors and solutions:

### [](#_invalid_credentials)Invalid credentials

**Error**: "Authentication failed" or "Invalid username/password"

**Solutions**:

*   Verify username and password are correct
    
*   Check if user exists
    
*   Ensure user hasn’t been deleted
    

### [](#_connection_refused)Connection refused

**Error**: "Connection refused" or "Unable to connect"

**Solutions**:

*   Verify server address and port
    
*   Check if TypeDB server is running
    
*   Check that TLS is either enabled on both driver and server, or disabled on both driver and server
    
*   Ensure network connectivity
    

### [](#_tlsencryption_errors)TLS/encryption errors

**Error**: "TLS handshake failed" or "Certificate validation failed"

**Solutions**:

*   Check that TLS is either enabled on both driver and server, or disabled on both driver and server
    
*   Check certificate paths and validity
    

[Connections](../connections/index.md) [Transactions](../transactions/index.md)

[Edit on GitHub](https://github.com/typedb/typedb-docs/edit/3.x-development/core-concepts/modules/ROOT/pages/drivers/authentication.adoc) Edit this page on GitHub.