Source: https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authentication/sessionless/
Documentation version: v5.3.2

# Sessionless mode

Sessionless mode lets SDK clients connect to NebulaGraph Database Developer Edition with an empty username and password. The Graph service checks request privileges using the identity set by `sessionless_user`.

Shared user privileges

All sessionless clients share this user's privileges. Use a dedicated regular user and grant only the privileges the application needs. Do not use the service group owner or a user with `ADMIN`.

## Prerequisites

- Start NebulaGraph Database Developer Edition by following [Deploy Developer Edition with Docker Compose](https://dev-docs.nebula-graph.io/v5.3.2/get-started/deploy/).
- Have the Meta service's `root` password and a Graph service account with `ADMIN`.
- Identify the schemas, graphs, and operations the application needs so that you can grant the required privileges.

## Configure sessionless mode

This example uses the regular user `testUser1`. Run user creation commands inside the `ngctl` container. Edit configuration and manage containers from the deployment directory on the development machine. For PowerShell syntax, see [Windows PowerShell](https://dev-docs.nebula-graph.io/v5.3.2/get-started/deploy/#powershell).

1. 

Follow [Run ngctl with Docker Compose](https://dev-docs.nebula-graph.io/v5.3.2/utilities/ngctl/#docker-compose) to log in to the Meta service, then create the user:

````
ngctl user create testUser1 --password testPassword1

````

2. 

[Connect to the Graph service](https://dev-docs.nebula-graph.io/v5.3.2/get-started/first-query/#connect) as a user with `ADMIN`, then invite the user and grant the connection privilege:

````
'''
INVITE USER testUser1
'''

'''
GRANT CONNECT TO USER testUser1
'''

````

Follow [Configure user access](https://dev-docs.nebula-graph.io/v5.3.2/server-admin/authorization/configure-user-access/) to grant the resource privileges the application needs. Access to a non-default schema requires `USAGE`; querying a graph also requires `MATCH`.

3. 

Return to the development machine's terminal. Append `--sessionless_user=testUser1` to `services.graphd.command` in `compose.yaml`, keeping the existing arguments. The list should look as follows. Keep the rest of the service configuration unchanged:

````
services:
  graphd:
    command:
      - --meta_server_addrs=graph-cluster:9559
      - --port=9669
      - --host=graph-cluster
      - --memory_dynamic_reserved_gb=1
      - --sessionless_user=testUser1

````

4. 

Check and apply the configuration from the directory containing `compose.yaml`. This recreates the Graph container and interrupts its existing connections:

````
docker compose config --quiet
ACCEPT_EULA=Y docker compose up -d graphd

````

Check container status with `docker compose ps --all`. Running only `docker compose restart graphd` does not apply the changed startup arguments.

5. 

Set both the username and password to `""` in the SDK and connect to the Graph service. Run `RETURN 1 AS result` and expect `1`. Then run an application query to confirm that `testUser1` can access the required resources. For connection code, see the [Java SDK guide](https://dev-docs.nebula-graph.io/v5.3.2/clients/java-client/) and [Go SDK guide](https://dev-docs.nebula-graph.io/v5.3.2/clients/go-client/).

## Disable sessionless mode

Remove `--sessionless_user=testUser1` from `services.graphd.command`, save the file, and run these commands from the deployment directory:

````
docker compose config --quiet
ACCEPT_EULA=Y docker compose up -d graphd

````

After the Graph container is recreated, clients can no longer sign in with an empty username and password. Reconnect with a normal username and password.

Sessionless mode skips Meta user authentication, so disabling `testUser1` alone does not stop this access. Revoking the user's `CONNECT` prevents new sessionless connections but does not automatically end existing connections.