# Connect to your Postgres

From the portal, from code, or from an agent. Use placeholders here; copy the real values from your instance.

## 1. Get the connection string

Portal: open your instance and its **Connection **card. REST: `GET /instances/{id}/connection `(see the [REST API reference ](https://docs.lathe.live/api)). MCP: `get_connection_urls `(see the [MCP reference ](https://docs.lathe.live/mcp)).

Use port `6432 `(pooled) for most apps and serverless workloads. Use `5432 `(direct) for migrations, `LISTEN/NOTIFY `, session-level settings, and advisory locks held across transactions. The owner URL can write and create databases. The read-only URL uses `pg_read_all_data `and every transaction is read-only.

## 2. Set the IP allowlist

Portal: instance → Settings → Network. REST: `PUT /instances/{id}/allowlist `. MCP: `set_allowlist `. An empty list is open to the internet; TLS and a password are still required. Changes are effective within a minute.

## 3. Connect with psql

Download the box CA from the Connection card. Name its real path: libpq otherwise looks for `~/.postgresql/root.crt `.

```
psql "postgres://OWNER:PASSWORD@INSTANCE.box.lathe.computer:5432/app?sslmode=verify-full&sslrootcert=/path/to/lathe-ca.crt"
```

## 4. Connect from code off the box

```
PGHOST=INSTANCE.box.lathe.computer
PGPORT=6432
PGUSER=OWNER
PGPASSWORD=PASSWORD
PGDATABASE=app
PGSSLMODE=verify-full
PGSSLROOTCERT=/path/to/lathe-ca.crt
```

Use the pooled port for serverless. Apps running on the box get `DATABASE_URL `injected, including the CA path; see the [apps tutorial ](https://docs.lathe.live/tutorials#what-an-app-gets).

## 5. Databases and extensions

Portal: instance → Postgres. REST: `POST /instances/{id}/postgres/databases `. MCP: `create_database `and `set_extension `. Supported extensions include `pgvector `, `pg_trgm `, and `pgcrypto `; for embeddings, see [pgvector on a dedicated Postgres machine ](https://docs.lathe.live/guides/pgvector). Bringing an existing database: [how to move a Postgres database with pg_dump and pg_restore ](https://docs.lathe.live/guides/migrate-postgres).

## 6. Browser SQL console

Portal: instance → Postgres → SQL console. REST: `PUT /instances/{id}/sql-console `. MCP: `set_sql_console `. Modes are off, read-only, and read-write. Read-only runs as the read-only database role, so Postgres itself refuses writes.

## 7. When it does not connect

- Check that your current IP is allowed.
- Use `verify-full `with the downloaded CA at the exact path you named.
- Use 5432 when the client needs a session; use 6432 for ordinary transactions.
- After rotating a password, replace every old URL.
- Check the plan's `postgres_connections `limit in `GET /plans `or `list_plans `.
[Previous Your own machine ](https://docs.lathe.live/machine)[Next Plans, limits and policies ](https://docs.lathe.live/limits)

## Related

- [Move a Postgres database with pg_dump and pg_restore ](https://docs.lathe.live/guides/migrate-postgres)

Moving a PostgreSQL database between providers in three commands: dump, restore, switch the connection string. What to check, and how to keep downtime short.
- [pgvector embeddings on a dedicated Postgres machine ](https://docs.lathe.live/guides/pgvector)

Embeddings are big and cheap to rebuild. Run pgvector on a dedicated machine with storage and 20 TB of traffic included, from $15 a month. Nothing metered.
- [Redis to Postgres: cache, queue, or one machine ](https://docs.lathe.live/guides/redis-to-postgres)

Cache-aside, queues and data moves between Redis 8 and PostgreSQL 17, with real commands and the decision criteria for one machine or two.