# db sign (/docs/cli/db-sign) > For the complete Prisma documentation index, see [llms.txt](https://www.prisma.io/docs/llms.txt). A markdown version of any docs page is available by appending `.md` to its URL. Sign a database with the current Prisma ORM contract. Location: CLI > db sign `db sign` verifies that the live database satisfies the emitted contract and, if so, writes or updates the database signature. The signature records that this database instance matches a specific contract version. It signs every contract space: your application's contract, and the contract of each extension that ships one, such as pgvector or PostGIS. It verifies each space, then signs every space that verified, in one transaction on PostgreSQL and SQLite. A space that fails verification is not signed: the command prints its differences and exits with code `4`. It is safe to run more than once, and safe to run in CI or a deployment pipeline. Use it after importing or inferring an existing schema, or after a deployment flow that already applied the required database changes. After a successful signature, `db sign` also stores the signed contract as a snapshot and points the [ref](https://www.prisma.io/docs/cli/migration-ref) named `db` of each signed space at it, so the next [`migration plan`](https://www.prisma.io/docs/cli/migration-plan) starts from the state you just signed instead of from an empty database. Unlike `db init` and `db update`, passing `--db` does not turn this off, because you normally sign the real database. Pass `--no-advance-ref` when you do not want the command to write a ref or a snapshot, for example in a deployment pipeline. ## Usage [#usage] #### bun ```bash bunx prisma db sign --db "$DATABASE_URL" ``` #### pnpm ```bash pnpm prisma db sign --db "$DATABASE_URL" ``` #### yarn ```bash yarn prisma db sign --db "$DATABASE_URL" ``` #### npm ```bash npx prisma db sign --db "$DATABASE_URL" ``` ## Options [#options] | Argument or option | What it does | | ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `[contract]` | Signs against a specific contract state instead of the emitted contract. Accepts a [contract reference](https://www.prisma.io/docs/orm/migrations/the-migration-graph#contract-reference-forms): a hash, a hash prefix, a [ref name](#contract-references), a migration directory name, or [`^`](#contract-references). It refuses `@contract`, `@db`, and `@empty` with the error code `MIGRATION.REF_WRONG_GRAMMAR`. To sign against the contract in `contract.json`, leave the argument out. | | `--db ` | Connects to the database. | | `--contract ` | The same value as `[contract]`, passed as an option in place of the argument. | | `--advance-ref ` | Advances this ref instead of `db` after a successful signature. | | `--no-advance-ref` | Signs without writing any ref or snapshot. Cannot be combined with `--advance-ref`. | | `--config ` | Read this config file instead of `./prisma.config.ts`. | | `--json` | Prints a machine-readable result, with one outcome per contract space. See [JSON output](#json-output). | ### Contract references [#contract-references] A ref name is a name you gave a contract state with [`migration ref set`](https://www.prisma.io/docs/cli/migration-ref), such as `prod`. `^` is a migration directory name followed by `^`, and it names the contract state before that migration, while the directory name alone names the state after it. [Contract references each command accepts](https://www.prisma.io/docs/orm/migrations/the-migration-graph#contract-reference-forms) lists the forms for every command. ## Exit codes [#exit-codes] | Code | Meaning | | ---- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `0` | Every contract space was signed. | | `2` | The command could not run: unresolvable contract reference, no emitted contract, or unreachable database. Also used when it signed the database but could not write every ref. | | `4` | Schema verification failed for a space, or another process changed that space's signature while `db sign` ran. That space's signature was not written. | ## Data lines [#data-lines] Without `--json`, standard output gets one line per contract space, with these fields separated by tabs: `space`, `status`, and the storage hash of the space's contract. `status` is the same value as in the JSON output below. [Global flags](https://www.prisma.io/docs/cli/global-flags#data-lines-of-prisma-orm-commands) lists the rules data lines follow. ```bash npx prisma db sign --db "$DATABASE_URL" | cut -f1,2 ``` ## JSON output [#json-output] With `--json`, `db sign` prints one JSON object per line, as every command does (see [JSON output](https://www.prisma.io/docs/cli/configuration#json-output)). The last line has `"kind": "result"`, and its `envelope.result` is this document: ```json title="db sign --json output" { "ok": true, "summary": "Database signed", "spaces": [ { "space": "app", "status": "updated", "contract": { "storageHash": "…", "profileHash": "…" }, "previous": { "storageHash": "…", "profileHash": "…" } } ], "advancedRefs": [{ "space": "app", "name": "db", "hash": "…" }] } ``` `spaces` has one entry per contract space, with the hashes of its contract in `contract`. `status` is one of: | Status | Meaning | | ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `created` | The space had no signature, and now has one. | | `updated` | The signature held other hashes, now in `previous`. | | `unchanged` | The signature already held the contract's hashes. | | `failed` | Verification failed. The entry has `schema`, the verification result, and `ok` is `false`. | | `conflict` | Another process, such as `db migrate`, changed the signature while `db sign` ran. The entry has `expected` and `found`, the hashes `db sign` read and the ones it found. Run `db sign` again once that process has finished. | `advancedRefs` lists each ref the command moved. It is empty with `--no-advance-ref`. When a space fails verification, the `--json` output has a diagnostic with the code `CONTRACT.SCHEMA_VERIFICATION_FAILED`, and its `meta.schemaIssues` lists the differences. [Schema differences in JSON output](https://www.prisma.io/docs/cli/db-verify#schema-differences-in-json-output) describes each field. Since `8.0.0-rc.15`, the document has this shape. Before, it was `{ ok, summary, contract, target, marker }` for the application's space only. ## Example [#example] #### bun ```bash bunx prisma contract emit bunx prisma db sign --db "$DATABASE_URL" bunx prisma db verify --db "$DATABASE_URL" ``` #### pnpm ```bash pnpm prisma contract emit pnpm prisma db sign --db "$DATABASE_URL" pnpm prisma db verify --db "$DATABASE_URL" ``` #### yarn ```bash yarn prisma contract emit yarn prisma db sign --db "$DATABASE_URL" yarn prisma db verify --db "$DATABASE_URL" ``` #### npm ```bash npx prisma contract emit npx prisma db sign --db "$DATABASE_URL" npx prisma db verify --db "$DATABASE_URL" ``` ## Adopting an existing database [#adopting-an-existing-database] After [`contract infer`](https://www.prisma.io/docs/cli/contract-infer) and `contract emit`, one `db sign` is enough to hand the database over to Prisma ORM: #### bun ```bash bunx prisma db sign --db "$DATABASE_URL" bunx prisma migration plan --name add-users-bio ``` #### pnpm ```bash pnpm prisma db sign --db "$DATABASE_URL" pnpm prisma migration plan --name add-users-bio ``` #### yarn ```bash yarn prisma db sign --db "$DATABASE_URL" yarn prisma migration plan --name add-users-bio ``` #### npm ```bash npx prisma db sign --db "$DATABASE_URL" npx prisma migration plan --name add-users-bio ``` The plan starts from the signed contract, so it contains only the change you made after signing. Because `migrations/app/` is still empty, that first plan also writes a baseline package that records the schema you adopted; see [the automatic baseline](https://www.prisma.io/docs/cli/migration-plan#the-automatic-baseline). ## When to use it [#when-to-use-it] Use `db sign` only after you believe the live database already matches the emitted contract. It is common after: * `contract infer` for an existing database * a manually reviewed migration flow * a database restore that you need to mark as matching the current contract * a Prisma ORM upgrade that changes your contract's storage hash but not the database When you upgrade from a release before `8.0.0-rc.19` and emit the contract again, the contract's storage hash can change even though the database does not. The storage hash is the `storageHash` value in `contract.json`, and `db sign` records it in the database. It changes for these contracts: * a SQLite contract with a datetime or JSON column * a PostgreSQL contract whose defaults `contract emit` now writes in another form * a contract that used `@noCheck`, which this release removes Until you sign, the database still holds the old hash, so `db migrate` fails with `MIGRATION.MARKER_MISMATCH` and `db verify` fails with `CONTRACT.MARKER_MISMATCH`. So after you emit the new contract, run `db sign` against every database that Prisma ORM 8 has already signed or migrated, which usually means development, staging, and production. Do not use `db sign` to hide drift. If verification fails, `db sign` writes no signature and offers two ways out. One changes the database: run `prisma db update` to make the database match the contract, then sign again. The other leaves the database as it is: change the contract source to describe the database, run `contract emit` again, then sign again. ## Related pages - [`auth`](https://www.prisma.io/docs/cli/auth): Sign in to your Prisma account from the CLI, sign out, and manage workspace sessions. - [`branch`](https://www.prisma.io/docs/cli/branch): List platform branches for a project. - [`bucket`](https://www.prisma.io/docs/cli/bucket): Create and manage object-store buckets. - [`Configuration`](https://www.prisma.io/docs/cli/configuration): Configure Prisma ORM CLI commands with prisma.config.ts and global flags. - [`contract emit`](https://www.prisma.io/docs/cli/contract-emit): Emit Prisma ORM contract artifacts.