Recommended Free Tools
MySQL error 1142 means the account authenticated successfully but is not authorized to run the requested CREATE operation. Copy the exact 'user'@'host' shown in the error, inspect that account with SHOW GRANTS, then grant CREATE at the smallest scope that matches the job. For a typical application that must create tables in one schema, an administrator would use:
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
GRANT CREATE ON mydb.* TO 'app'@'host';If the command is CREATE ROLE, this is a different case: the account needs the global CREATE ROLE or CREATE USER privilege, and a server in read_only mode also requires CONNECTION_ADMIN (or the deprecated SUPER privilege).
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsWhat “CREATE command denied” means
The message is an authorization failure, not a syntax error. MySQL identifies it as error 1142, ER_TABLEACCESS_DENIED_ERROR. The standard form is:
%s command denied to user '%s'@'%s' for table '%s'The first value is the operation MySQL refused, followed by the account name, the host associated with the connection, and the object involved. A successful login only proves that authentication worked; it does not give the account every privilege.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
The CREATE privilege enables database and table creation. It must be present for the account that MySQL actually matched, at a scope that covers the object being created. Granting a privilege to a similar-looking account, such as 'app'@'localhost' when the connection is matched to 'app'@'10.20.30.%', does not change the permissions of the current session.
Read the error and identify the real account
Do not start by granting a broad privilege. First copy the user and host exactly as displayed. MySQL accounts are pairs written as 'user_name'@'host_name'; the same user name with a different host is a different account row.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →- User: the account name between the first pair of quotes.
- Host: the host portion after the
@. It may belocalhost, an IP address, a hostname, or a wildcard such as%. - Object: the table or schema named at the end of the message, when MySQL includes it.
From the failing connection, these checks help distinguish the account supplied by the client from the account MySQL authenticated:
SELECT USER(), CURRENT_USER(), DATABASE();USER() shows the user and host supplied by the client. CURRENT_USER() shows the account row whose privileges are being used. DATABASE() shows the default schema selected for the session, or NULL when no schema is selected. Run the query through the same connection method that receives the denial; checking from a local administrator session can produce a different result.
Host matching is a common reason a grant appears to have had no effect. For example, these are separate accounts:
'app'@'localhost'
'app'@'127.0.0.1'
'app'@'10.20.30.%'
'app'@'%'A grant to one does not automatically grant the others. MySQL also chooses the most specific matching account row, so the row used by the session may not be the wildcard row you inspected first.
Inspect the account’s current grants
Use an administrative session or another account that is allowed to inspect grants. Substitute the exact user and host from CURRENT_USER() or the error:
SHOW GRANTS FOR 'app'@'host';Read each returned statement for the privilege and scope. A result such as GRANT USAGE ON *.* confirms that the account exists but does not grant table creation. A database-level statement such as GRANT SELECT, INSERT ON `mydb`.* also does not include CREATE.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
If the account receives privileges through roles, SHOW GRANTS can show role assignments as well as direct privileges. Record both:
- Which role is granted to the account.
- Whether that role is active in the failing session.
- Whether the role itself contains
CREATEat a scope covering the target.
Inspecting grants from the same account that is denied is not always possible, because a restricted application account may lack the right to inspect its own grant metadata. In that situation, have a database administrator run SHOW GRANTS FOR with the exact account notation.
Choose the smallest privilege scope that solves the task
The safest fix depends on what the account must create. The following scopes are different choices, not interchangeable syntax:
| Scope | Example | Use when | Risk and notes |
|---|---|---|---|
| One table object | GRANT CREATE ON mydb.mytable TO 'app'@'host'; |
The operation and your MySQL version support a table-level grant and the account must be limited to one object. | Most restrictive, but table-level support and the exact CREATE operation must be verified for the server version. It may not cover creating a new table whose name does not yet exist. |
| One database | GRANT CREATE ON mydb.* TO 'app'@'host'; |
The account needs to create tables or databases objects within one schema. | Usually the practical least-privilege choice for an application confined to one schema; it does not grant CREATE in other schemas. |
| All databases | GRANT CREATE ON *.* TO 'app'@'host'; |
Only when the account genuinely administers creation across the server. | Broad global authority. A mistake or compromised credential can create objects in every database. |
| Role-based delivery | GRANT 'app_developer' TO 'app'@'host'; |
Privileges are managed centrally for several accounts. | The role must itself contain the required CREATE privilege and must be active in the session. |
Do not use a global grant merely because it is shorter. Match the grant to the schema and operation, and keep separate application accounts for separate environments when possible.
Grant CREATE for a database or schema
For the common case—an application needs to create tables in mydb—an administrator can grant database-level CREATE:
GRANT CREATE ON mydb.* TO 'app'@'host';Quote the account exactly. If the host contains a wildcard, retain it inside the host quotes:
GRANT CREATE ON mydb.* TO 'app'@'10.20.30.%';If the account does not yet exist, create it deliberately with an authentication method and password policy appropriate for your installation, then grant only the required privileges. Do not silently create a second account with a different host because the original host was mistyped; that can leave the application using the old, unprivileged row.
After the grant, verify what MySQL stored:
SHOW GRANTS FOR 'app'@'host';Normal GRANT statements take effect through MySQL’s privilege system; manually editing grant tables is not a substitute and can introduce inconsistencies. If an administrator edited system tables directly, that is a separate recovery procedure and should be handled according to the server version’s administration guidance.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
When a table-level grant is appropriate
A table-level form can be used where the operation and server version support it:
GRANT CREATE ON mydb.mytable TO 'app'@'host';Use this only when you understand what MySQL is creating. A permission tied to an existing table name may not authorize an attempt to create an entirely new table with another name, and some CREATE statements involve more than one object. If the application runs schema migrations that create many tables, a database-level grant on the migration schema is generally easier to reason about than a long list of table-specific grants.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Keep related privileges separate. An account may need additional rights for the complete migration—for example, permissions to insert, alter, or reference data—but adding those privileges does not replace the missing CREATE privilege. Grant each required capability at the narrowest practical scope.
Use a role when privileges are managed centrally
Roles let an administrator package privileges once and assign them to multiple accounts. A role-based fix has two parts: the role must contain CREATE, and the role must be granted and active for the session that fails.
For example, an administrator can assign an existing role:
GRANT 'app_developer' TO 'app'@'host';Then inspect both sides:
SHOW GRANTS FOR 'app_developer';
SHOW GRANTS FOR 'app'@'host';An inactive role does not supply its privileges to the current session. A connection may therefore continue to receive error 1142 even though the role assignment is visible in the account’s grants. Activate the role using the role configuration your deployment uses, or explicitly for a diagnostic session with the appropriate SET ROLE statement. Reconnect or reapply the session’s role policy before retesting; a connection pool can preserve old session state while new connections receive the updated configuration.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Roles are useful when development, migration, and runtime accounts need consistent policies. They also make review easier: auditors can inspect the role once instead of comparing many direct grants. The trade-off is operational—an incorrectly active role can expose every privilege bundled into it, so keep the role narrowly defined.
CREATE ROLE is a different privilege problem
If the denied statement is CREATE ROLE, granting database-level CREATE is not the fix. MySQL requires the executing account to have the global CREATE ROLE or CREATE USER privilege for that statement.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
CREATE ROLE 'reporting_role';The role is initially locked, has no password, and uses the default authentication plugin. Those properties are normal for a role; they do not indicate that the CREATE operation failed.
When the server’s read_only setting is enabled, the account also needs CONNECTION_ADMIN (or the deprecated SUPER privilege) to execute CREATE ROLE. Check the server mode and the account’s global grants rather than repeatedly adding schema-level CREATE:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchSHOW GRANTS FOR 'app'@'host';Because these are global administrative privileges, grant them only to a controlled administration account. A runtime application account normally should not be able to create users or roles.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Retry with the same identity and schema
Once the grant or role change is complete, test through the same connection path used by the application. A command-line test from a different host can match a different MySQL account.
- Connect using the application’s configured user, host, port, and authentication method.
- Run
SELECT USER(), CURRENT_USER(), DATABASE();and confirm the values match the account and schema you changed. - If no schema is selected, choose the intended one with
USE mydb;or qualify the statement with the schema name. - Run the smallest representative CREATE statement, preferably in a disposable test schema or with a migration dry-run process your application supports.
- Confirm the object was created, then remove the test object if it is not needed.
Use a harmless, uniquely named test table when testing table creation:
CREATE TABLE mydb.permission_check_1142 (id INT);
DROP TABLE mydb.permission_check_1142;Do not run a destructive test in production merely to prove a grant. Coordinate with the migration owner and use a maintenance window or isolated schema when the account is connected to live data.
Free tools Windows power users keep installed
One-click scans. No signup required.
If CREATE still fails after the grant
The host variant is wrong
Compare CURRENT_USER() with the account in the grant. If the session is 'app'@'10.20.30.%' but the administrator granted 'app'@'localhost', repeat the grant for the matched host or correct the application’s connection route. Do not assume that identical user names share privileges.
The schema is not the one you granted
Check DATABASE() and the fully qualified object name. A grant on mydb.* does not authorize creation in otherdb.*. Migration tools can also switch schemas between steps, so inspect the generated SQL and connection settings.
The role is assigned but inactive
Confirm that the role appears in the account’s grants, that the role contains CREATE, and that the current session has activated it. Test a fresh connection after changing default-role or pool settings; existing pooled sessions may retain their previous role state.
The statement needs another privilege
Some operations that look like table creation also involve indexes, triggers, routines, views, temporary tables, or data changes. The server may report a different denied privilege after CREATE is fixed. Grant only that newly demonstrated requirement, at the relevant scope, rather than responding with an unrestricted global grant.
The command is actually CREATE ROLE or CREATE USER
Re-read the statement and error text. User and role administration uses the separate global requirements described above, not the schema-level CREATE grant used for ordinary database objects.
A connection pool is reusing old credentials or sessions
Verify which secret, username, host, and endpoint the application is using. Restart or recycle pooled connections only under the application’s normal deployment procedure, then repeat the identity checks. A successful grant to one server does not affect a different replica, development instance, or container endpoint.
Prevent the error without over-privileging accounts
- Separate runtime and migration identities. A web application that only reads and writes data should not automatically receive schema-changing privileges. Give CREATE to the controlled migration account when possible.
- Document the account host. Record the exact
'user'@'host'pair in deployment configuration and runbooks so an administrator does not grant the wrong row. - Prefer schema-level grants to global grants. Keep creation rights inside the one database that the service owns.
- Use roles for repeatable policy. Define a narrowly scoped role, review its contents, and make its activation policy explicit for connection pools and administrative sessions.
- Review grants after migrations. Run
SHOW GRANTSfor the actual account and remove temporary CREATE rights when a one-time migration is complete. - Keep an audit trail. Record who approved the grant, the target schema, the reason, and the expected removal date for temporary access.
Worked diagnosis
Suppose an application reports:
ERROR 1142 (42000): CREATE command denied to user 'app'@'10.20.30.45' for table 'orders_archive'The administrator should not grant CREATE to a guessed local account. First, identify the matching account and inspect it:
SHOW GRANTS FOR 'app'@'10.20.30.45';If the server uses a wildcard host row, the exact value may instead be 'app'@'10.20.30.%'; use the value shown by CURRENT_USER(). If the application is intended to create tables only in sales, apply the narrow grant:
GRANT CREATE ON sales.* TO 'app'@'10.20.30.%';
SHOW GRANTS FOR 'app'@'10.20.30.%';The application then reconnects, confirms DATABASE() is sales, and retries its migration. If the same error remains, the next checks are the host row, the selected schema, and whether the migration is actually issuing CREATE ROLE or another statement with separate requirements—not an automatic jump to GRANT CREATE ON *.*.
Final checklist
- Copy the complete error, including error number 1142, user, host, and object.
- Run
SELECT USER(), CURRENT_USER(), DATABASE();through the failing connection. - Have an administrator run
SHOW GRANTS FOR 'user'@'host';for the matched account. - Grant
CREATEon the required table or schema, choosing the narrowest supported scope. - If using a role, grant it to the account and make sure it is active in the session.
- If the statement is
CREATE ROLE, use the separate global privilege rules and checkread_only. - Reconnect or refresh the application’s pooled sessions, then test the same schema and identity.
- Remove temporary privileges and document the final grant.
When these checks agree, a CREATE denial is usually resolved without changing passwords, disabling security controls, or granting server-wide authority. The durable fix is the correct CREATE privilege on the exact account MySQL matched, delivered at the narrowest scope that supports the operation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
