Not all databases require passwords to authenticate. I'd imagine most popular ones don't nowadays. https://www.postgresql.org/docs/12/client-authentication.ht

Not all databases require passwords to authenticate. I'd imagine most popular ones don't nowadays. https://www.postgresql.org/docs/12/client-authentication.html https://www.postgresql.org/docs/12/client-authentication.htm... I imagine developing something like equifax today, you'd want to hook up it up to your SSO, and used row based security so a user can only read their row, and then you focus your efforts making sure user accounts, especially privileged ones such as staff, aren't being abused. (You'd still probably establish system to system level trust, such as keys between your API and DB). But it's so much easier and cheaper just to connect using a username and password, and then do whatever the framework you chose does by default.