--- title: "How to Send a Temporary Database Login to a Contractor" url: https://uselinkpilot.com/blog/how-to-send-a-temporary-database-login-to-a-contractor-securely description: "Create a scoped database user with an expiry, send the password as a one-time link instead of an email, lock down the connection and close the account on time." lang: en --- Security (https://uselinkpilot.com/blog/category/security) # How to send a temporary database login to a contractor securely Create a scoped database user with an expiry, send the password as a one-time link instead of an email, lock down the connection and close the account on time. LinkPilot Team (https://uselinkpilot.com/author/linkpilot-team) · The people who build and run LinkPilot at TetraCore, LLC October 25, 2026 · About LinkPilot (https://uselinkpilot.com/about) A contractor who needs to fix an import, tune a query or migrate a table usually needs a database login to do it. The risk is rarely the contractor. It is the login itself: created in a hurry, broader than the task, pasted into an email, and still working six months after the invoice was paid. The fix is a short routine. Decide whether direct access is needed at all, create a user that is scoped and already has an end date, send the password through a one-time secret link (https://uselinkpilot.com/tools/free-secret-link-generator) rather than a message that keeps copies, lock down the network path, and close the account when the work is done. This guide walks through each step with the exact commands where they help. ## Does the contractor need direct database access? Start with the task, not the request. "Fix the import" could mean reading one table, or it could mean write access to half the schema. Ask for the operation, the environment and the tables involved, then look for a cheaper way to give it. - **A staging database** with a recent, sanitised copy covers most diagnostic and migration work with no exposure of live customer records. - **An application or admin API (https://uselinkpilot.com/glossary#api)** is often enough when the contractor needs to change data rather than schema. - **A read replica** gives read-only analysis work a place to run without touching the primary. If none of those fit and production access is unavoidable, write a one-line note of why. That note becomes the justification when someone audits the access later. ## Create a user that is scoped and already expiring Never hand over a shared login or an employee's credentials. A dedicated user is the thing that lets you see what the contractor did, restrict what they can reach, and remove them without affecting anyone else. Set the expiry on the user when you create it, so access ends even if you forget. In PostgreSQL, a user that can only read two tables and stops working on a fixed date looks like this: ```sql CREATE ROLE contractor_jo LOGIN PASSWORD 'generated-elsewhere' VALID UNTIL '2026-11-08 18:00+00'; GRANT CONNECT ON DATABASE app TO contractor_jo; GRANT USAGE ON SCHEMA public TO contractor_jo; GRANT SELECT ON orders, order_items TO contractor_jo; ``` MySQL has `CREATE USER ... PASSWORD EXPIRE INTERVAL 14 DAY`, and managed services such as RDS, Cloud SQL and Supabase let you do the same from their consoles or with IAM-based short-lived tokens. Use whichever your platform supports, and generate the password with a password manager rather than typing one. Grant the smallest set of permissions that completes the named task. For a diagnostic job that means `SELECT` on specific tables. For a migration it means write access to the objects that will change and nothing else. Owner and superuser roles are never the right answer for a temporary account. ## How to send a temporary database login to a contractor The password is the only part of the handoff that has to stay secret. The host, port, database name and username are useful to an attacker but not sufficient, so they can travel in an ordinary message. Keep the two apart. 1. **Verify the recipient** through a channel you already trust, such as the contract email thread or a call. Lookalike addresses are a common way for a credential to go to the wrong inbox. 2. **Create a one-time secret (https://uselinkpilot.com/glossary#one-time-link) link** containing only the password. With LinkPilot the text is encrypted in your browser before it is stored, the stored copy is destroyed the first time the link is opened, and you can pick an expiry of one hour, 24 hours or seven days. Pro accounts can set a custom expiry, add a passphrase and see an audit timeline of when the link was opened. 3. **Send the link in the normal thread**, with a one-line note of what it is for and when it expires. Do not include the username in the same message as the link. 4. **Send the connection details separately**: host, port, database, username, and whether TLS is required. A second email or a ticket comment is fine, because nothing in it is secret on its own. 5. **Pass on a passphrase by a different channel** if you set one, for example by text message or on a call. 6. **Ask the contractor to confirm** that the link opened. If it says it has already been viewed and they did not open it, treat the password as exposed and rotate it. A password manager's share feature is a reasonable alternative when the contractor is already in your vault. For a one-off engagement, a one-time link avoids creating an account just to hand over one value. The secret links vs password managers (https://uselinkpilot.com/blog/secret-links-vs-password-managers) guide covers when each one fits. ## Lock down the connection A well-scoped user on an open port is still a problem. Three controls close most of the gap. - **Require TLS** on the connection and tell the contractor to set `sslmode=require` or the equivalent in their client. Many clients fall back to plain text silently if you do not insist. - **Restrict the source** with an IP allowlist (https://uselinkpilot.com/glossary#allowlist), a VPN or a bastion host. Allowlisting the contractor's address for the duration of the work is quick to set up and quick to remove. - **Share only what the task needs.** The contractor does not need the internal network diagram, the other databases on the server or the admin console URL. If your platform offers short-lived IAM tokens instead of static passwords, that is usually the better choice, and it removes the password handoff entirely. ## Watch the account and close it out Turn on authentication and query logging for the new user before the work starts, so you can compare what happened against what was agreed. Logins at odd hours or queries against unrelated tables are worth a question, not an accusation. When the task ends, or the scope changes, do four things the same day: 1. **Drop or disable the user** and confirm it can no longer connect. 2. **Remove the network allowance** you added for them. 3. **Rotate any secret that travelled with the login**, for example an application password that was in the same ticket. 4. **Record the handoff**: who had access, to what, from when to when, and why. Keep the record, not the password. A temporary login that is scoped, expiring, delivered once and closed on time is not a security exception. It is just how contractor access should work. ## Related reading - How to share API keys securely: https://uselinkpilot.com/blog/how-to-share-api-keys-securely - Secure link sharing for developers: https://uselinkpilot.com/blog/secure-link-sharing-for-developers - How one-time secret links work: https://uselinkpilot.com/blog/how-one-time-secret-links-work - Expiring links: the secret is destroyed, not just redirected: https://uselinkpilot.com/blog/expiring-links-security ## Tools for this article One-Time Secret Link Generator Share a password or note through a link that opens once. https://uselinkpilot.com/tools/free-secret-link-generator Self-Destructing Message Send a note that disappears after one read. https://uselinkpilot.com/tools/burn-after-read-secret Expiring Link Generator Create links that stop working at a set time. https://uselinkpilot.com/tools/temporary-link ## Frequently asked questions ### Is it safe to send a database password by email? ### Should a contractor use an employee's database login? ### How long should temporary database access last? ### What permissions should a contractor get? ### Should the contractor connect to production or staging? ### Is a one-time link enough on its own to secure the login? ## LinkPilot sends a secret link that is gone after it is opened. Encrypted in your browser, revealed once, then destroyed. No account needed. Create a secret link (https://uselinkpilot.com/tools/free-secret-link-generator) ## Read next Security ### How to Create a Temporary Secure Link for Sharing Files Pick the right temporary link for the file, create one that expires and burns after one download, and use a secret sharing tool with file attachments safely. https://uselinkpilot.com/blog/how-to-create-a-temporary-secure-link-for-sharing-files Security ### Apps With Self-Destructing Messages: Signal, WhatsApp, Telegram and When a Link Is Better How disappearing messages work in Signal, WhatsApp and Telegram, what each timer deletes, what none of them stop, and when a one-time link fits better. https://uselinkpilot.com/blog/self-destructing-message-apps Link Tracking ### How to Integrate a Branded Link Shortener With Slack Set up a branded domain, install a Slack app that shortens links and turns pasted passwords into one-time links, fix previews and read the clicks. https://uselinkpilot.com/blog/how-to-integrate-a-branded-link-shortener-with-slack ## Structured data ```json [ { "@context": "https://schema.org", "@type": "SoftwareApplication", "@id": "https://uselinkpilot.com/#software", "name": "LinkPilot", "applicationCategory": "BusinessApplication", "operatingSystem": "Web", "description": "LinkPilot is a secure link management platform for creating branded short links, tracking engagement, and sharing secrets with expiring, protected, self-destructing links.", "url": "https://uselinkpilot.com", "offers": [ { "@type": "Offer", "name": "Free", "price": "0", "priceCurrency": "USD", "url": "https://uselinkpilot.com/pricing" }, { "@type": "Offer", "name": "Pro", "price": "29", "priceCurrency": "USD", "priceSpecification": { "@type": "UnitPriceSpecification", "price": "29", "priceCurrency": "USD", "billingDuration": "P1M" }, "url": "https://uselinkpilot.com/pricing" }, { "@type": "Offer", "name": "Agency", "price": "299", "priceCurrency": "USD", "priceSpecification": { "@type": "UnitPriceSpecification", "price": "299", "priceCurrency": "USD", "billingDuration": "P1M" }, "url": "https://uselinkpilot.com/pricing" }, { "@type": "Offer", "name": "Agency Plus", "price": "799", "priceCurrency": "USD", "priceSpecification": { "@type": "UnitPriceSpecification", "price": "799", "priceCurrency": "USD", "billingDuration": "P1M" }, "url": "https://uselinkpilot.com/pricing" }, { "@type": "Offer", "name": "Enterprise", "priceSpecification": { "@type": "PriceSpecification", "priceCurrency": "USD" }, "url": "https://uselinkpilot.com/pricing" } ] }, { "@context": "https://schema.org", "@type": "Organization", "@id": "https://uselinkpilot.com/#organization", "name": "LinkPilot", "alternateName": "LinkPilot by TetraCore", "url": "https://uselinkpilot.com", "contactPoint": { "@type": "ContactPoint", "contactType": "customer support", "email": "support@uselinkpilot.com", "url": "https://uselinkpilot.com/support" }, "parentOrganization": { "@type": "Organization", "@id": "https://tetracorehq.com/#organization", "name": "TetraCore", "url": "https://tetracorehq.com/" }, "logo": { "@type": "ImageObject", "url": "https://uselinkpilot.com/logo-512.png", "width": 512, "height": 512 }, "description": "LinkPilot is a secure link management platform for creating branded short links, tracking engagement, and sharing secrets with expiring, protected, self-destructing links.", "sameAs": [ "https://x.com/uselinkpilot", "https://www.linkedin.com/company/uselinkpilot", "https://facebook.com/uselinkpilot", "https://github.com/TetraCoreHQ/linkpilot-cli", "https://github.com/TetraCoreHQ/linkpilot-mcp", "https://www.npmjs.com/package/linkpilot", "https://www.npmjs.com/package/@uselinkpilot/sdk", "https://www.npmjs.com/package/@uselinkpilot/mcp", "https://chromewebstore.google.com/detail/linkpilot-short-links-and/mnmppadihpcncicldpkmgknhnjkondad" ] }, { "@context": "https://schema.org", "@type": "WebSite", "name": "LinkPilot", "url": "https://uselinkpilot.com", "potentialAction": { "@type": "SearchAction", "target": "https://uselinkpilot.com/blog?q={search_term_string}", "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://uselinkpilot.com/" }, { "@type": "ListItem", "position": 2, "name": "Blog", "item": "https://uselinkpilot.com/blog" }, { "@type": "ListItem", "position": 3, "name": "How to Send a Temporary Database Login to a Contractor Securely", "item": "https://uselinkpilot.com/blog/how-to-send-a-temporary-database-login-to-a-contractor-securely" } ] }, { "@context": "https://schema.org", "@type": "BlogPosting", "@id": "https://uselinkpilot.com/blog/how-to-send-a-temporary-database-login-to-a-contractor-securely#article", "headline": "How to Send a Temporary Database Login to a Contractor Securely", "description": "Create a scoped database user with an expiry, send the password as a one-time link instead of an email, lock down the connection and close the account on time.", "datePublished": "2026-10-25", "dateModified": "2026-10-25", "image": "https://uselinkpilot.com/logo-512.png", "author": { "@type": "Organization", "@id": "https://uselinkpilot.com/author/linkpilot-team#organization", "name": "LinkPilot Team", "url": "https://uselinkpilot.com/author/linkpilot-team" }, "publisher": { "@type": "Organization", "name": "LinkPilot", "url": "https://uselinkpilot.com", "logo": { "@type": "ImageObject", "url": "https://uselinkpilot.com/logo-512.png", "width": 512, "height": 512 } }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://uselinkpilot.com/blog/how-to-send-a-temporary-database-login-to-a-contractor-securely" } }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Is it safe to send a database password by email?", "acceptedAnswer": { "@type": "Answer", "text": "No. Email keeps a copy in the sender's outbox, the recipient's inbox, every synced device and the backups of both mail providers. Send the password as a one-time secret link and keep the email for the non-secret details." } }, { "@type": "Question", "name": "Should a contractor use an employee's database login?", "acceptedAnswer": { "@type": "Answer", "text": "No. Give the contractor their own user. You can then see what that user did, set its own expiry, and remove it without touching anyone else's access." } }, { "@type": "Question", "name": "How long should temporary database access last?", "acceptedAnswer": { "@type": "Answer", "text": "Long enough for the agreed work plus a short buffer for review. Set the expiry on the database user itself as well as on the link you used to deliver the password, and shorten it rather than extend it when the scope is unclear." } }, { "@type": "Question", "name": "What permissions should a contractor get?", "acceptedAnswer": { "@type": "Answer", "text": "The smallest set that completes the named task. Read access to the specific tables for a diagnostic job, write access only to the objects they will change, and never a superuser or owner role." } }, { "@type": "Question", "name": "Should the contractor connect to production or staging?", "acceptedAnswer": { "@type": "Answer", "text": "Staging or a sanitised copy whenever the work allows it. If production is unavoidable, write down why, restrict the user tightly and review the activity logs afterwards." } }, { "@type": "Question", "name": "Is a one-time link enough on its own to secure the login?", "acceptedAnswer": { "@type": "Answer", "text": "No. The link protects the handoff of the password. The database user, its permissions, its expiry and the network path still have to be set up correctly, and the user still has to be removed at the end." } } ] } ] ```