Skip to content

Password from shell command

DBeaver can read a database password from the output of a shell command or script instead of storing the password in the connection settings. On each connect, DBeaver runs the command and uses the first line of its output as the password.

The password returned by the command isn't saved to disk. This works well when a command-line tool can print the password, or for short-lived credentials that rotate often.

Tip

This authentication method runs a single command to fetch a password. To run scripts on connection events - before or after connect and disconnect - see Shell commands.

Enable password retrieval via CLI

Password retrieval via CLI is disabled by default. To turn it on:

  1. Open Window -> Preferences -> Connections.
  2. Select Enable password retrieval via CLI.
  3. Click Apply and Close.

Once enabled, Password from shell command appears in the Authentication dropdown when you configure a connection.

Note

This method works with databases that support username/password authentication. It replaces the password step, so the username still comes from the connection settings.

Shell command authentication

  1. From the Authentication dropdown menu, select Password from shell command.

  2. In the Username field, enter the database username.

  3. In the Command field, enter the shell command that prints the password.

    Info

    DBeaver reads the first line of its output (stdout) and uses it as the password. See Examples.

  4. Leave the Working directory field empty when the Command has the full path to the script. To use a relative command like sh pg-password.sh, set this field to the folder that contains the script.

  5. In the Timeout (ms) field, set how long DBeaver waits for the command to finish, in milliseconds. The default is 60000. Raise it if the command is slow to respond.

  6. Click the Test Connection button to verify your settings. If everything is configured correctly, DBeaver connects using the password returned by the command.

    Important

    The command runs on your machine with your permissions, and its output is treated as a password. Only enter commands you trust, and avoid printing the password to logs or the console.

Examples

macOS and Linux

Create a script that prints the password:

#!/bin/sh
echo "myPassword"

In practice, the script can call a command-line tool that prints the password. For example, 1Password provides the op CLI:

#!/bin/sh
op read "op://Private/PostgreSQL/password"

Save it as pg-password.sh, then enter this in the Command field:

sh /path/to/pg-password.sh

Windows

Create a batch file that prints the password:

@echo myPassword

In practice, the batch file can call a command-line tool that prints the password, for example, 1Password's op:

@echo off
op read "op://Private/PostgreSQL/password"

Save it as pg-password.bat, then enter this in the Command field:

cmd /c C:\path\to\pg-password.bat