db sign
Sign a database with the current Prisma ORM contract.
db sign verifies that the live database satisfies the emitted contract and, if so, writes or updates the database signature. The signature records that this database instance is aligned with a specific contract version.
It is idempotent and safe to run in CI or a deployment pipeline. Use it after importing or inferring an existing schema, or after a deployment flow that already applied the required database changes.
After a successful signature, db sign also stores the signed contract as a snapshot and points the ref named db at it, so the next migration plan starts from the state you just signed instead of from an empty database. Unlike db init and db update, passing --db does not turn this off, because you normally sign the real database. Pass --no-advance-ref when you do not want the command to write a ref or a snapshot, for example in a deployment pipeline.
Usage
bunx prisma@latest db sign --db "$DATABASE_URL"Options
| Argument or option | What it does |
|---|---|
[contract] | Signs against a specific contract reference (hash, prefix, ref name, or migration directory name) instead of the emitted contract. |
--db <url> | Connects to the database. |
--contract <contract> | The contract reference as a flag. Also accepts the <dir>^ and ./path forms that the positional argument does not. |
--advance-ref <name> | Advances this ref instead of db after a successful signature. |
--no-advance-ref | Signs without writing any ref or snapshot. Cannot be combined with --advance-ref. |
--config <path> | Read this config file instead of ./prisma.config.ts. |
--json | Prints a machine-readable result. It includes advancedRef with the ref name and contract hash, or null when no ref was written. |
Exit codes
| Code | Meaning |
|---|---|
0 | The database was signed. |
2 | The command could not run: unresolvable contract reference, no emitted contract, or unreachable database. |
4 | Schema verification failed and no signature was written. |
Example
bunx prisma@latest contract emit
bunx prisma@latest db sign --db "$DATABASE_URL"
bunx prisma@latest db verify --db "$DATABASE_URL"Adopting an existing database
After contract infer and contract emit, one db sign is enough to hand the database over to Prisma ORM:
bunx prisma@latest db sign --db "$DATABASE_URL"
bunx prisma@latest migration plan --name add-users-bioThe plan starts from the signed contract, so it contains only the change you made after signing. Because migrations/app/ is still empty, that first plan also writes a baseline package that records the schema you adopted; see the automatic baseline.
When to use it
Use db sign only after you believe the live database already matches the emitted contract. It is common after:
contract inferfor a brownfield database- a manually reviewed migration flow
- a database restore that you need to mark as matching the current contract
Do not use db sign to hide drift. If verification fails, fix the contract or database first.