Connectors

MySQL and MariaDB

Configuration options and limitations for the MySQL and MariaDB connectors, and setup notes for the managed and compatible services they connect to.

Configure the Connection

MySQL and MariaDB are supported as separate connectors. Select the connector that matches your server. Every option on this page also applies to the managed and compatible services built on these connectors, such as Amazon RDS, PlanetScale, and TiDB.

Supported Versions

Database	Minimum Tested Version
MySQL	8.4
MariaDB	10.7

These are the lowest versions tested against Monospace. Older versions are untested and may not work.

Connection Parameters

Parameter	Type	Required	Default	Description
`host`	string	Yes	—	Database server hostname or IP address
`port`	number	Yes	—	Database server port
`user`	string	Yes	—	Database username
`password`	string	Conditional	—	Database password. Required unless `aws_iam` is set
`dbname`	string	No	—	Database name
`ssl.mode`	string	No	—	SSL connection mode
`ssl.ca_cert`	string	No	—	CA certificate (base64-encoded PEM or DER)

Alternatively, paste a connection string to auto-populate fields:

MySQL

mysql://user:password@host:3306/database

MariaDB

mariadb://user:password@host:3306/database

The MySQL connector accepts mysql://. The MariaDB connector accepts mariadb://.

Use the sslmode query parameter in the URL to set ssl.mode.

AWS IAM Authentication

Amazon RDS and Aurora instances can authenticate with AWS IAM instead of a database password. Set aws_iam on the connection and omit password — exactly one of the two must be present. Each connection mints a short-lived token; tokens are never reused across connections.

Parameter	Type	Required	Default	Description
`aws_iam.region`	string	Yes	—	AWS region of the database instance, for example `us-east-1`
`aws_iam.access_key`	string	No	—	AWS access key ID. Must be paired with `aws_iam.secret_key`
`aws_iam.secret_key`	string	No	—	AWS secret access key. Must be paired with `aws_iam.access_key`
`aws_iam.role_arn`	string	No	—	IAM role to assume, for example `arn:aws:iam::123456789012:role/my-role`

Omit access_key and secret_key to use whatever credentials the runtime provides — an EC2 instance profile, an EKS/IRSA web identity token, an ECS task role, or a shared credentials profile. AWS IAM Identity Center (SSO) profiles are not supported.

The database user is still required, and must be granted IAM authentication on the instance.

Note

Setting aws_iam forces ssl.mode to verify-full, and the Amazon RDS certificate authority for aws_iam.region is trusted automatically — you do not need to download the RDS CA bundle and set ssl.ca_cert. An explicit ssl.ca_cert still takes precedence.

In the Studio, choose AWS IAM as the Authentication Method when adding the data source. It is offered on the PostgreSQL, MySQL, and MariaDB connectors and on the Amazon RDS and Aurora tiles.

SSL Modes

Mode	Description
`disable`	No TLS encryption
`prefer`	Not supported. Choose `disable`, `require`, `verify-ca`, or `verify-full`
`require`	Require TLS without certificate verification. If `ssl.ca_cert` is provided, verifies the server certificate against it
`verify-ca`	Require TLS and verify the server certificate chain against `ssl.ca_cert`. Does not check hostname. Requires `ssl.ca_cert`
`verify-full`	Require TLS, verify the certificate chain, and verify hostname. Uses the default trusted roots when `ssl.ca_cert` is omitted

Note

Mutual TLS is not yet supported for MySQL/MariaDB.

Limitations

Collections need a primary key for updates and deletes.
Primary key values cannot currently be changed.
Foreign keys that reference non-unique field sets are not supported, even if Monospace shows no error. Add a unique index or model the relation through a junction collection before connecting the data source.

Managed and Compatible Services

The Studio's connector picker has a tile for each service below. Every tile uses the MySQL or MariaDB connector, so the options, SSL modes, and limitations above all apply. A tile only adapts the form to the service: it shows the service's connection string format, sets its default port where it differs, and displays its setup notes.

Only the Amazon RDS and Aurora tiles offer AWS IAM authentication. Every other tile connects with a username and password.

Service	Connector	Notes
Aiven for MySQL	MySQL	—
Amazon Aurora MySQL	MySQL	Offers AWS IAM authentication
Amazon RDS for MariaDB	MariaDB	Offers AWS IAM authentication
Amazon RDS for MySQL	MySQL	Offers AWS IAM authentication
Azure Database for MySQL	MySQL	Flexible Server. Use a plain username, without the legacy `user@server` suffix
DigitalOcean Managed MySQL	MySQL	Default port `25060`
Google Cloud SQL for MySQL	MySQL	Allowlist your client IP under Connections → Networking. Public IPs are numeric, so use the Cloud SQL Auth Proxy for hostname-based access
Oracle MySQL HeatWave	MySQL	The endpoint has a private IP address only. Connect through an OCI compute instance, the OCI Bastion service, or a VPN
Percona Server for MySQL	MySQL	—
PlanetScale Vitess	MySQL	Beta
Railway MySQL	MySQL	External connections use Railway's TCP Proxy. Internal connections use the private hostname
SingleStore	MySQL	Beta
TiDB	MySQL	Beta. Default port `4000`

A Beta badge on a tile marks a service that speaks the MySQL protocol but that Monospace doesn't yet test first-party.

A service that runs standard MySQL or MariaDB doesn't need its own tile: choose MySQL or MariaDB. If you need a service that isn't listed, request it on the roadmap.