MySQL — error 1045 Access denied for user

Resolve MySQL 1045 access denied by checking user host matching, authentication plugin and password configuration.

beginnerdebuggingmysqlauth

Symptoms

Access denied for user 'app'@'10.0.0.5' (using password: YES)
It works with the mysql client but not from the application
Connecting from a different host changes the error
A user exists but connections still fail

Possible causes

No grant matches the user and the connecting host
The password differs from what the app sends
The authentication plugin is incompatible with the client library
The user exists for localhost but the connection comes from another host

Diagnosis steps

Read the exact user and host in the error

mysql -e "select user, host, plugin from mysql.user"

Interpretation

MySQL matches user and host pairs, so a user defined only for localhost does not match a remote connection.

Verify the password and plugin

mysql -e "select user, host, plugin from mysql.user where user='app'"

Interpretation

A caching_sha2_password user with an old client fails even with the correct password.

Test the same credentials directly

mysql -h db -u app -p -e "select 1"

Interpretation

Reproducing outside the app distinguishes a credential problem from an application configuration problem.

Root cause

The presented credentials did not match a grant for that user and host, because the account lacks a matching host entry, the password differs, or the authentication plugin is unsupported by the client.

Fix

Create or grant the user for the actual connecting host, set the correct password, and choose an authentication plugin the client supports, then flush privileges.

Verify the fix

Connect again with the application and confirm success, and confirm the granted privileges are sufficient for the operations it performs.

Symptom walkthrough

A connection fails with Access denied for user, and the message names the exact user and host MySQL evaluated. MySQL matches accounts by both user and host, so a user created for localhost does not satisfy a connection arriving from a container network. Alternatively the password may differ from what the client sends, or the user uses an authentication plugin the old client library does not support.

Fix in practice

Create or grant the account for the host the connection actually comes from, set the intended password, and align the authentication plugin with what the client can negotiate. After changes, flush privileges so grants take effect. Testing the same credentials with the mysql client isolates credential from configuration problems.

Verification

Reconnect from the application and confirm success, then confirm the account has the privileges the application needs. A successful connection with adequate grants confirms the fix.

Diagnostic commands

Check the behavior with commands like these:

mysql -e "select user, host, plugin from mysql.user"
mysql -e "select user, host, plugin from mysql.user where user='app'"
mysql -h db -u app -p -e "select 1"