PlanetScale "Error 1045: Access denied" in CI

By Kaveh Alemi·Latchkey

PlanetScale generates a username and password per branch through "pscale password create". A 1045 access-denied means the credential does not match the branch you are connecting to: it was made for another branch, was deleted, or was never regenerated for the per-PR branch.

What this error means

A MySQL client fails with "ERROR 1045 (28000): Access denied for user 'xxxx'@'...'" against a PlanetScale host, while the branch itself exists and is reachable.

ERROR 1045 (28000): Access denied for user 'abcd1234'@'10.0.0.5'
(using password: YES)

Common causes

The password belongs to a different branch

PlanetScale passwords are scoped to a branch. A credential minted for main will not authenticate against the per-PR branch host.

The password was rotated or deleted

A stored secret refers to a password that was since revoked, so the login is denied.

How to fix it

Create a fresh password for the branch

1. Generate a password scoped to the per-PR branch at CI time.
2. Read the returned host, username, and password into env or a connection string.
3. Delete the password in cleanup so credentials do not accumulate.

pscale password create app "pr-${{ github.event.number }}" ci-pw \
  --org "$PLANETSCALE_ORG" --format json

Use the connection string PlanetScale returns

Consume the exact host and credentials from the password output rather than assembling them by hand.

# parse the JSON output into a DSN for the branch
DATABASE_URL="mysql://$USER:$PASS@$HOST/app?sslaccept=strict"

How to prevent it

• Mint a branch-scoped password per run instead of reusing one.
• Read the host and username from the password output, not by assumption.
• Delete per-PR passwords on cleanup to avoid stale credentials.

Frequently asked questions

Related guides

References

• GitHub Actions documentation