db sign
db sign verifies that the live database satisfies the emitted contract and, if so, writes or updates the database signature. The signature records that this database instance matches a specific contract version.
It is idempotent and safe to run in CI or a deployment pipeline. Use it after importing or inferring an existing schema, or after a deployment flow that already applied the required database changes.
After a successful signature, db sign also stores the signed contract as a snapshot and points the ref named db at it, so the next migration plan starts from the state you just signed instead of from an empty database. Unlike db init and db update, passing --db does not turn this off, because you normally sign the real database. Pass --no-advance-ref when you do not want the command to write a ref or a snapshot, for example in a deployment pipeline.
bunx prisma db sign --db "$DATABASE_URL"pnpm prisma db sign --db "$DATABASE_URL"yarn prisma db sign --db "$DATABASE_URL"npx prisma db sign --db "$DATABASE_URL"| Argument or option | What it does |
|---|---|
[contract] |
Signs against a specific contract reference (hash, prefix, ref name, or migration directory name) instead of the emitted contract. |
--db <url> |
Connects to the database. |
--contract <contract> |
The contract reference as a flag. Also accepts the <dir>^ and ./path forms that the positional argument does not. |
--advance-ref <name> |
Advances this ref instead of db after a successful signature. |
--no-advance-ref |
Signs without writing any ref or snapshot. Cannot be combined with --advance-ref. |
--config <path> |
Read this config file instead of ./prisma.config.ts. |
--json |
Prints a machine-readable result. It includes advancedRef with the ref name and contract hash, or null when no ref was written. |
| Code | Meaning |
|---|---|
0 |
The database was signed. |
2 |
The command could not run: unresolvable contract reference, no emitted contract, or unreachable database. |
4 |
Schema verification failed and no signature was written. |
bunx prisma contract emit
bunx prisma db sign --db "$DATABASE_URL"
bunx prisma db verify --db "$DATABASE_URL"pnpm prisma contract emit
pnpm prisma db sign --db "$DATABASE_URL"
pnpm prisma db verify --db "$DATABASE_URL"yarn prisma contract emit
yarn prisma db sign --db "$DATABASE_URL"
yarn prisma db verify --db "$DATABASE_URL"npx prisma contract emit
npx prisma db sign --db "$DATABASE_URL"
npx prisma db verify --db "$DATABASE_URL"After contract infer and contract emit, one db sign is enough to hand the database over to Prisma ORM:
bunx prisma db sign --db "$DATABASE_URL"
bunx prisma migration plan --name add-users-biopnpm prisma db sign --db "$DATABASE_URL"
pnpm prisma migration plan --name add-users-bioyarn prisma db sign --db "$DATABASE_URL"
yarn prisma migration plan --name add-users-bionpx prisma db sign --db "$DATABASE_URL"
npx prisma migration plan --name add-users-bioThe plan starts from the signed contract, so it contains only the change you made after signing. Because migrations/app/ is still empty, that first plan also writes a baseline package that records the schema you adopted; see the automatic baseline.
The plan starts from the signed contract, so it contains only the change you made after signing. Because migrations/app/ is still empty, that first plan also writes a baseline package that records the schema you adopted; see the automatic baseline.
Use db sign only after you believe the live database already matches the emitted contract. It is common after:
contract inferfor a brownfield database- a manually reviewed migration flow
- a database restore that you need to mark as matching the current contract
Do not use db sign to hide drift. If verification fails, fix the contract or database first.