services.pgbouncer.authUser

If authUser is set, then any user not specified in authFile will be queried through the authQuery query from pg_shadow in the database, using authUser. The password of authUser will be taken from authFile. (If the authUser does not require a password then it does not need to be defined in authFile.)

Direct access to pg_shadow requires admin rights. It's preferable to use a non-superuser that calls a SECURITY DEFINER function instead.