Enhancing API-Based Database Access Security
In multi-tenant SaaS environments, applications are often provisioned automatically, making programmatic access to database connection details essential.
Rather than exposing permanent MySQL usernames and passwords, Cloudways could improve security by introducing:
Short-lived database access tokens generated through the API
API-driven credential rotation and management
Webhooks or event notifications triggered when new applications are deployed (https://wheelielife.io/)
These capabilities would enable safer automation workflows, reduce the risks associated with long-term credential exposure, and better accommodate modern SaaS deployment architectures.
Wang Evelyn
shared this idea
-
Almed Batlex commented
Strong suggestion. Short-lived tokens and automated credential rotation are much safer than permanent MySQL usernames and passwords, especially when applications are provisioned automatically and credentials end up in scripts, CI logs or old config files. A few details would make this even more useful: tokens scoped to a single database with read-only and read-write options, an expiry time the user can set, an audit log showing when each token was issued and used, and a webhook payload that never contains the secret itself, only a reference to fetch it securely over the API. The same problem appears in enterprise integrations, for example when SaaS applications connect to ERP systems, and teams that provide SAP custom development (https://clearance-nbi.ph/) usually handle it with token-based service users and rotation policies instead of shared passwords. Voted for this idea, and I hope the Cloudways team considers it.
-
timo42heren
commented
Instead of generating permanent MySQL usernames and passwords per application, the Cloudways API should allow developers to request temporary, time-bound database access tokens (similar to AWS IAM database authentication or HashiCorp Vault). If a token is compromised, it automatically expires within minutes, drastically reducing the blast radius. https://www.changehealthcareprovider.com