Skip to main content

Connect a PostgreSQL database

Learn how to connect your PostgreSQL database to Retool.

You can use the PostgreSQL integration to create a resource and make it available in Retool. Once complete, your users can write queries that interact with PostgreSQL data.

Requirements

The PostgreSQL integration requirements depend on whether you have a cloud-hosted or self-hosted Retool organization. You may also need to make PostgreSQL configuration changes before creating the resource.

Sufficient user permissions to create resources

All users for Retool organizations on Free or Team plans have global Edit permissions and can add, edit, and remove resources. If your organization manages user permissions for resources, you must be a member of a group with Edit all permissions.

Allow Retool to access the data source

If the data source is behind a firewall or restricts access based on IP address, then you must ensure that your Retool organization can access it. If necessary, configure your data source to allow access from Retool's IP addresses.

CIDR IP addresses
3.77.79.248/30
35.90.103.132/30
44.208.168.68/30
Individual IP addresses
3.77.79.249
3.77.79.250
35.90.103.132
35.90.103.133
35.90.103.134
35.90.103.135
44.208.168.68
44.208.168.69
44.208.168.70
44.208.168.71

Retool is building support for querying firewalled resources without allowlisting Retool’s IP address. To learn more or be considered for early access, contact cloud-connect@retool.com.

PostgreSQL settings and authentication

You must have sufficient access and familiarity with your PostgreSQL data source so you can provide:

  • Required connection settings (e.g., URL and server variables).
  • Authentication credentials (e.g., API keys).

In some cases, you may need to make changes to your PostgreSQL configuration, such as generating authentication credentials or allowing access through a firewall. Refer to the configuration and authentication sections to learn more.

1. Configure the resource

Sign in to your Retool organization and navigate to the Resources tab. Click Create new > Resource, then select PostgreSQL.

Configuration

Specify the name, location, and description to use for your PostgreSQL resource. Retool displays the resource name and type in query editors to help users identify them.

Provide the following configuration settings to create the resource. Depending on how your data source is configured, you may also need to provide optional settings for Retool to connect.

You can automatically populate resource configuration fields by importing an AWS-hosted data source or providing a database connection string.

Name

The name to use for the resource.

Description

A description of the resource.

Host

The host server address.

Port

The host server connection port.

Database name

The name of the database to use.

Connection options

Key-value pairs to configure the connection.

Disable converting queries to prepared statements

Whether to disable SQL injection protection that allows dynamically generated SQL using JavaScript.

Show write GUI mode only

Whether to prevent users from writing raw SQL statements and only make changes using GUI mode queries.

Enable SSH tunnel

Whether to enable SSH tunneling.

Bastion host

The Bastion host.

Bastion port

The Bastion port.

Override default outbound Retool region

Retool connects to your data source from the us-west-2 region. Choosing a different outbound region can improve performance through geographic proximity.

RegionLocation
us-west-2US West (Oregon)
eu-central-1(Frankfurt, Germany)

Authentication

The PostgreSQL integration supports the following authentication methods. Depending on which authentication method you use, you may need to make changes to your PostgreSQL configuration.

Username and password

Authentication is performed with a username and password. You must be able to obtain and provide these credentials to create the resource.

AWS Identity and Access Management

Authentication is performed using the provided AWS security credentials. You must be able to obtain and provide these credentials to create the resource.

Database username

The username with which to authenticate.

Region

The AWS region with which to connect (e.g., us-east-1). This is often part of the base URL.

RegionLocation
us-east-1US East (N. Virginia)
us-east-2US East (Ohio)
us-west-1US West (N. California)
us-west-2US West (Oregon)
af-south-1Africa (Cape Town)
ap-east-1Asia Pacific (Hong Kong)
ap-northeast-1Asia Pacific (Tokyo)
ap-northeast-2Asia Pacific (Seoul)
ap-northeast-3Asia Pacific (Osaka)
ap-south-1Asia Pacific (Mumbai)
ap-south-2Asia Pacific (Bahrain)
ap-southeast-1Asia Pacific (Singapore)
ap-southeast-2Asia Pacific (Sydney)
ap-southeast-3Asia Pacific (Jakarta)
ap-southeast-4Asia Pacific (Hong Kong)
ca-central-1Canada (Central)
eu-central-1Europe (Frankfurt)
eu-central-2Europe (Warsaw)
eu-north-1Europe (Stockholm)
eu-south-1Europe (Milan)
eu-south-2Europe (London)
eu-west-1Europe (Ireland)
eu-west-2Europe (London)
eu-west-3Europe (Paris)
me-central-1Middle East (Bahrain)
me-south-1Middle East (Bahrain)
sa-east-1South America (São Paulo)
us-gov-east-1AWS GovCloud (US-East)
us-gov-west-1AWS GovCloud (US-West)
Access key ID

The access key ID with which to authenticate.

Secret key ID

The secret key ID with which to authenticate.

Role to assume (ARN)

A different role to use for accessing the API.

SSL/TLS validation

Retool strongly recommends enabling SSL/TLS certificate validation whenever it's available. This ensures the connection is secure and prevents attackers from using invalid server certificates to gain access to your data.

Some resources support or require SSL/TLS validation. If needed, provide the following information to configure SSL.

CA Cert

The CA certificate to use.

Client key

The client key.

Client cert

The client certificate.

Verification mode

The mode with which Retool performs SSL/TLS verification.

ModeDescription
Full verificationVerifies the server host matches the name stored in the server certificate and checks the CA certificate.
Verify CA certificateThis verifies the server by checking the certificate chain up to the root certificate stored on the client.
Skip CA certificate verification CautionThis establishes an encrypted connection without CA certificate verification. This mode is not recommended as your server could be vulnerable.

3. Test the connection

Click Test Connection to verify that Retool can successfully connect to the data source. If the test fails, check the resource settings and try again.

Testing a connection only checks whether Retool can successfully connect to the resource. It cannot check whether the provided credentials have sufficient privileges or can perform every supported action.

4. Save the resource

Click Create resource to complete the setup. You can then click either Create app to immediately start building a Retool app or Back to resources to return to the list of resources.

Wrap up

Your PostgreSQL resource is now ready to use. To start querying data:

  1. Add a Resource query to an app or workflow.
  2. Select the PostgreSQL resource from the resources dropdown.
  3. Write and run a query.

Refer to the queries documentation to learn more about interacting with your data.