What causes "Permission denied for domain: {domain}" in clockworklabs/SpacetimeDB?

Pick a different, more specific new name (e.g. prefix with your org/user handle)

clockworklabs/SpacetimeDB · error · anyhow::Error

Permission denied for domain: {domain}

Error message

Permission denied for domain: {domain}

What it means

Response mapping for `spacetime rename` (`PUT /v1/database/{identity}/names`): the server answered non-success and the `SetDomainsResult` body was `PermissionDenied { domain }` — the authenticated identity is not allowed to claim the requested domain name. Domains are a flat namespace with per-domain ownership/permissions, so a name can be taken or restricted even though the database itself is fine.

Source

Thrown at crates/cli/src/subcommands/dns.rs:53

    let domain: DomainName = domain.parse()?;

    let builder = reqwest::Client::new()
        .put(format!(
            "{}/v1/database/{database_identity}/names",
            config.get_host_url(server)?
        ))
        .header(reqwest::header::CONTENT_TYPE, "application/json")
        .body(serde_json::to_string(&[&domain])?);
    let builder = add_auth_header_opt(builder, &auth_header);

    let response = builder.send().await?;
    let status = &response.status();
    let result: SetDomainsResult = response.json_or_error().await?;

    if !status.is_success() {
        anyhow::bail!(match result {
            SetDomainsResult::Success => "".to_string(),
            SetDomainsResult::PermissionDenied { domain } => format!("Permission denied for domain: {domain}"),
            SetDomainsResult::PermissionDeniedOnAny { domains } =>
                format!("Permission denied for domains: {domains:?}"),
            SetDomainsResult::DatabaseNotFound => format!("Database {database_identity} not found"),
            SetDomainsResult::NotYourDatabase { .. } =>
                format!("You cannot rename {database_identity} because it is owned by another identity."),
            SetDomainsResult::OtherError(err) => err,
        });
    }

    println!("Name set to {domain} for identity {database_identity}.");

    Ok(())
}

View on GitHub (pinned to 524b4487d9)

Solutions

Pick a different, more specific new name (e.g. prefix with your org/user handle)
If you believe you should own the domain, verify you are logged in as the right identity (`spacetime login`, `spacetime identity show`)
Check for typos in the `--to` value — a mistyped existing name will read as 'permission denied'
Contact the server operator if the name is yours but incorrectly assigned

Example fix

# before
spacetime rename --to shared-name <db-identity>
# after
spacetime rename --to acme-shared-name <db-identity>

Defensive patterns

Strategy: try-catch

Validate before calling

# Probe availability cheaply before rename (name collision check)
spacetime list | grep -q "$(spacetime rename --to x 2>/dev/null)" || true  # ultimately the server is authoritative

Try / catch

// Match the bail message and branch: 'Permission denied for domain' -> prompt for a different name; do not retry the same domain.

Prevention

Namespace your domains (org/user prefix) on shared servers
Verify the active identity before renaming

When it happens

Trigger: Renaming a database to a domain name owned or reserved by someone else, or one restricted by the host (e.g. trying to claim `myteam` when only members of that organization may use it); a typo landing on an existing domain.

Common situations: Choosing names that collide with other tenants on shared servers (maincloud); namespace policy changes on the host; assuming unpublished names are free when they are reserved.

Related errors

AI-assisted analysis of clockworklabs/SpacetimeDB@524b4487d9 (2026-08-16). Data as JSON: /api/errors/5ed7f3cb461f22d0. Report an issue: GitHub.