Create a read-only password
passwords & credentials
// what it does
--role reader scopes the credential to SELECTs — the right credential for dashboards, BI tools, and anything that should never write. Add --replica to route those reads to replicas and read-only regions, keeping analytical load off the primary.
// shell
$ pscale password create mydb main metabase-ro --role reader$ pscale password create mydb main reports --role reader --replica// gotcha
Roles are fixed at creation; to upgrade a reader to a writer you create a new password, you don't edit the old one. That's a feature: credentials are immutable and auditable.