Connect to your Postgres

From the portal, from code, or from an agent. Use placeholders here; copy the real values from your instance.

1. Get the connection string

Portal: open your instance and its Connection card. REST: GET /instances/{id}/connection. MCP: get_connection_urls.

Use port 6432 (pooled) for most apps and serverless workloads. Use 5432 (direct) for migrations, LISTEN/NOTIFY, session-level settings, and advisory locks held across transactions. The owner URL can write and create databases. The read-only URL uses pg_read_all_data and every transaction is read-only.

2. Set the IP allowlist

Portal: instance → Settings → Network. REST: PUT /instances/{id}/allowlist. MCP: set_allowlist. An empty list is open to the internet; TLS and a password are still required. Changes are effective within a minute.

3. Connect with psql

Download the box CA from the Connection card. Name its real path: libpq otherwise looks for ~/.postgresql/root.crt.

psql "postgres://OWNER:PASSWORD@INSTANCE.box.lathe.computer:5432/app?sslmode=verify-full&sslrootcert=/path/to/lathe-ca.crt"

4. Connect from code off the box

PGHOST=INSTANCE.box.lathe.computer
PGPORT=6432
PGUSER=OWNER
PGPASSWORD=PASSWORD
PGDATABASE=app
PGSSLMODE=verify-full
PGSSLROOTCERT=/path/to/lathe-ca.crt

Use the pooled port for serverless. Apps running on the box get DATABASE_URL injected, including the CA path; see the apps tutorial.

5. Databases and extensions

Portal: instance → Postgres. REST: POST /instances/{id}/postgres/databases. MCP: create_database and set_extension. Supported extensions include pgvector, pg_trgm, and pgcrypto.

6. Browser SQL console

Portal: instance → Postgres → SQL console. REST: PUT /instances/{id}/sql-console. MCP: set_sql_console. Modes are off, read-only, and read-write. Read-only runs as the read-only database role, so Postgres itself refuses writes.

7. When it does not connect

Check that your current IP is allowed.
Use verify-full with the downloaded CA at the exact path you named.
Use 5432 when the client needs a session; use 6432 for ordinary transactions.
After rotating a password, replace every old URL.
Check the plan's postgres_connections limit in GET /plans or list_plans.