CREATE USER [IF NOT EXISTS] user  [ auth_option ] [,  user  [ auth_option ]] ... DEFAULT ROLE  role  [,  role  ] ... [REQUIRE {NONE |  tls_option  [[AND]  tls_option ] ...}] [WITH  resource_option  [ resource_option ] ...] [ password_option  |  lock_option ] ... [COMMENT ’ comment_string ’ | ATTRIBUTE ’ json_object ’] user : (see Section 6.2.4, “Specifying Account Names” ) auth_option : { IDENTIFIED BY ’ auth_string ’ | IDENTIFIED BY RANDOM PASSWORD | IDENTIFIED WITH  auth_plugin | IDENTIFIED WITH  auth_plugin  BY ’ auth_string ’ | IDENTIFIED WITH  auth_plugin  BY RANDOM PASSWORD | IDENTIFIED WITH  auth_plugin  AS ’ auth_string ’ } tls_option : { SSL  | X509  | CIPHER ’ cipher ’  | ISSUER ’ issuer ’  | SUBJECT ’ subject ’ } resource_option : { MAX_QUERIES_PER_HOUR  count | MAX_UPDATES_PER_HOUR  count | MAX_CONNECTIONS_PER_HOUR  count | MAX_USER_CONNECTIONS  count } password_option : { PASSWORD EXPIRE [DEFAULT | NEVER | INTERVAL  N  DAY] | PASSWORD HISTORY {DEFAULT |  N } | PASSWORD REUSE INTERVAL {DEFAULT |  N  DAY} | PASSWORD REQUIRE CURRENT [DEFAULT | OPTIONAL] | FAILED_LOGIN_ATTEMPTS  N | PASSWORD_LOCK_TIME { N  | UNBOUNDED} } lock_option : { ACCOUNT LOCK | ACCOUNT UNLOCK } To use  CREATE USER , you must have the global  CREATE USER  privilege, or the  INSERT  privilege for the mysql  system schema. When the  read_only  system variable is enabled,  CREATE USER  additionally requires the  CONNECTION_ADMIN  privilege (or the deprecated  SUPER  privilege). The  CREATE USER  statement creates new MySQL accounts. It enables authentication, role, SSL/TLS, resource-limit, and password-management properties to be established for new accounts. It also controls whether accounts are initially locked or unlocked. 2850 CREATE ROLE ’admin’, ’developer’; CREATE ROLE ’webapp’@’localhost’; Account Management Statements The host name part of the role name, if omitted, defaults to  ’%’ . For role usage examples, see Section 6.2.10, “Using Roles” . 13.7.1.3 CREATE USER Statement