---
title: Generating Ephemeral PostgreSQL Credentials
slug: kronpam-reference-guide-3-9-0/generating-ephemeral-postgresql-credentials
docTags: 
createdAt: 2026-10-10T13:46:52.459Z
---

PostgreSQL ephemeral credentials create a unique short-lived login role in the target database. The configured privileges are granted for the selected duration and the role is dropped after expiration.

      1.            Configure a PostgreSQL super account that can create roles, grant and revoke the required privileges, and drop roles.

      2.            Enable privileged operations in the PostgreSQL Vault configuration and define the **Super Username** and required password, or select a vault-managed super account.

      3.            Open the connector's **Just In Time** properties.

      4.            In **Command set for JIT Creation**, create a login role with the generated name and password, set its expiration time, and grant only the required database privileges.

      5.            In **Command set for JIT Revocation**, revoke the granted privileges and drop the generated role.

      6.            Use the supported runtime placeholders for the generated name, password, and expiration time.

:::hint{type="info"}
A PostgreSQL role name must start with a letter or underscore unless it is quoted. Use a Base account name that allows Kron PAM to generate a compatible alphanumeric role name.
:::

To generate and verify the credentials:

1.            Create or edit a **Static** account with **Account Subtype** set to **Ephemeral Base** and select the PostgreSQL configuration.

2.            Open the Base account action menu and select **Generate Ephemeral Account**.

3.            Select the required **Duration**, enter a **Comment**, and generate the credential.

4.            Verify that the Vault lists a unique **Dynamic** PostgreSQL account and a next lifecycle time based on the selected duration.

5.            Use the generated credential during the validity period, then verify that the PostgreSQL role is dropped after expiration.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/p1Evm9uk14wn9BfxOUMhm_image.png "Figure - Generated PostgreSQL account and expiration information in the Vault")