Connectors

PostgreSQL and Supabase

PostgreSQL and Supabase connector configuration options.

PostgreSQL

Tested with PostgreSQL 14 through 17.

Connection Parameters

Parameter	Type	Required	Default	Description
`host`	string	Yes	—	Database server hostname or IP address
`port`	number	Yes	`5432`	Database server port
`user`	string	Yes	—	Database username
`password`	string	Conditional	—	Database password. Required unless `aws_iam` is set
`dbname`	string	Yes	—	Database name

Alternatively, paste a connection string to auto-populate all fields:

Connection String

postgresql://user:password@host:5432/database

Amazon RDS and Aurora instances can authenticate with AWS IAM instead of a database password. Set aws_iam on the connection and omit password — exactly one of the two must be present. Each connection mints a short-lived token; tokens are never reused across connections.

Parameter	Type	Required	Default	Description
`aws_iam.region`	string	Yes	—	AWS region of the database instance, for example `us-east-1`
`aws_iam.access_key`	string	No	—	AWS access key ID. Must be paired with `aws_iam.secret_key`
`aws_iam.secret_key`	string	No	—	AWS secret access key. Must be paired with `aws_iam.access_key`
`aws_iam.role_arn`	string	No	—	IAM role to assume, for example `arn:aws:iam::123456789012:role/my-role`

Omit access_key and secret_key to use whatever credentials the runtime provides — an EC2 instance profile, an EKS/IRSA web identity token, an ECS task role, AWS SSO, or a shared credentials profile.

The database user is still required, and must be granted IAM authentication on the instance.

Setting aws_iam forces ssl.mode to verify-full, and the Amazon RDS certificate authority for aws_iam.region is trusted automatically — you do not need to download the RDS CA bundle and set ssl.ca_cert. An explicit ssl.ca_cert still takes precedence.

In the Studio, choose AWS IAM as the Authentication Method when adding the data source. It is offered on the PostgreSQL, MySQL, and MariaDB connectors and on the Amazon RDS and Aurora presets.

SSL Configuration

Parameter	Type	Description
`ssl.mode`	string	SSL connection mode (see below)
`ssl.ca_cert`	string	CA certificate (base64-encoded PEM or DER)
`ssl.client_cert`	string	Client certificate for mutual TLS (base64-encoded)
`ssl.client_key`	string	Client private key (base64-encoded)
`ssl.client_key_password`	string	Password for an encrypted client private key

SSL Modes

Mode	Description
`disable`	No TLS encryption
`prefer`	Attempt TLS, fall back to unencrypted if unavailable
`require`	Require TLS without certificate verification. If `ssl.ca_cert` is provided, verifies the server certificate against it (same behavior as `verify-ca`)
`verify-ca`	Require TLS and verify the server certificate chain. Does not check hostname. When `ssl.ca_cert` is omitted, validates against the platform's system root CAs
`verify-full`	Require TLS, verify the server certificate chain, and verify the hostname matches the certificate. When `ssl.ca_cert` is omitted, validates against the platform's system root CAs

For production deployments, use verify-full. Managed providers (Supabase, AWS RDS, Neon) use certificates signed by public CAs, so ssl.ca_cert is not required — the system root CA store handles validation. Provide ssl.ca_cert only for self-signed or private CAs.

Supported Key Formats

Client keys are accepted in the following formats, all normalized internally to PKCS#8:

PKCS#8 (PEM or DER)
Encrypted PKCS#8 PEM (requires ssl.client_key_password)
PKCS#1 RSA (PEM or DER)
SEC1 EC (PEM only)

Supabase

The Supabase connector is a preconfigured PostgreSQL preset. It uses the same PostgreSQL engine and supports all the same features — SSL, introspection, connection pooling, and transactions.

Select Supabase when connecting to a Supabase-hosted database. The configuration form is identical to PostgreSQL with a Supabase-specific connection string placeholder.

Connect to Supabase

Open your Supabase project dashboard and navigate to Project Settings > Database.
Copy the connection string (direct connection or session pooler).
In Monospace, add a new data source and select the Supabase connector.
Paste the connection string — all fields populate automatically.

Supabase provides two connection string formats:

Direct Connection

postgresql://postgres:[YOUR-PASSWORD]@db.[PROJECT-REF].supabase.co:5432/postgres

Session Pooler

postgresql://postgres.[PROJECT-REF]:[YOUR-PASSWORD]@aws-0-[REGION].pooler.supabase.com:5432/postgres

Supabase connections use PostgreSQL under the hood. All PostgreSQL configuration options, SSL modes, and capabilities apply.