---
title: "Connect to a database"
description: "Get the connection string for a TIR DBaaS database, as a URL, .env, psql, JDBC, or a framework snippet, over the internet or inside a VPC."
content_type: "how-to"
product: "tir-dbaas"
platform: "TIR"
url: "/tir/tir-dbaas/how-to/connect-to-a-database/"
topic: ["connect"]
relationships: {"requires":["/tir/tir-dbaas/how-to/create-a-database/"]}
---

# Connect to a database

<!-- cspell:ignore defaultdb Laravel -->

Copy the connection details of a database into your app, a terminal, or a database tool. The portal
gives them as a URL, as separate fields, and as ready-made commands and code for common languages
and frameworks.

## Before you begin

- A database in the **Running** state. See
  [Create a database](/tir/tir-dbaas/how-to/create-a-database/).
- The password of the user you connect as. The portal shows `<password>` in its place, so keep your
  own copy, or set a new one with
  [Reset a user's password](/tir/tir-dbaas/how-to/reset-a-user-password/).
- Network access to the database:
  - Over the internet, the address you connect from must be in the database's IP allowlist.
  - From a VM or service in a VPC, the database must be attached to that VPC.

  To change either, see [Control network access](/tir/tir-dbaas/how-to/control-network-access/).

## How connections are secured

Every connection from outside the database must use SSL and a password. Over the network, the
database accepts only encrypted logins. The URL the portal gives you ends in `sslmode=require`, and
**SSL mode** reads `require`. If you build your own connection settings, set the SSL mode to
`require` as well.

## Get the details from the Connect tab

Open the database's page and select the **Connect** tab. The details load once the database is
**Running**.

1. **What is this connection for?** offers **Applications & psql**, a direct connection for reads
   and writes. Use it for your apps and agents, and for psql, migrations, and bulk loads from a
   terminal.
2. **Where will it connect from?** appears only when the database is attached to a VPC. Choose
   **Public internet** to connect through the public endpoint from an address in the allowlist, or
   **Inside the VPC** to connect from VMs and services in the VPC through the database's private address.
3. Under **Connect as**, choose the login to connect as, including users you created with SQL. Every
   string and snippet on the tab follows your choice. **Reset Password** beside it sets a new password
   for the chosen user, if you have permission to update the database.
4. Under **Copy it into your app**, copy the details your app needs.

With **Public internet** chosen, the tab tells you who can reach the public endpoint: only the ranges in the allowlist,
any IPv4 address, or nobody yet. To change who can connect, select **Edit allowlist**, or **Add an
IP range** when the list is empty.

## Connection details

You get the full **URL**, and its **Host**, **Port**, **Database**, and **SSL mode** on their own.
The URL has this form:

```text
postgresql://<user>:<password>@<host>:5432/defaultdb?sslmode=require
```

- `<user>` is the user chosen under **Connect as**.
- `<password>` is that user's password. The connection details never include the password, so put it in yourself.
- `<host>` is the public endpoint, or the primary's VPC address when **Inside the VPC** is chosen.
- The port is 5432, and the database is `defaultdb`, the database every new TIR database starts
  with.

A password made with **Suggest** uses only letters, digits, hyphens, underscores, full stops, and
tildes, which can go into a URL as they are. If your password has other symbols, such as `@`, `#`, or
`/`, percent-encode them in the URL, for example `@` as `%40`.

## Copy a command or a snippet

To copy the details in another form:

- **Copy .env** copies two lines for an environment file: one with the URL, and one with
  the password.
- **Copy psql** copies a psql command that connects to the database.
- **Copy JDBC** copies the connection in JDBC form, for Java applications.

**Frameworks & snippets** has ready-made code for Node.js, Python, Django, Prisma, SQLAlchemy, Spring,
Drizzle, LangChain, Go, Rails, Laravel, .NET, and Rust. A snippet
that takes the password directly carries `<password>`; replace it with the real password, or read it
from your own secret store.

If your browser blocks copying, select the text and copy it
yourself.

## Use the Connect button for a quick copy

To copy a connection string in one step, select **Connect** at the top of the
database's page while it is **Running**. It always gives the read-write **Applications & psql**
connection.

1. For a database attached to a VPC, choose **Public internet** or **Inside the VPC** in **Connect
   from**.
2. In **Connect as**, choose the user.
3. In **Format**, choose the URL, .env, psql, or JDBC form, or any framework snippet from the
   **Connect** tab.
4. Select **Copy**.

**Reset password** here also sets a new password for the chosen user, if you have
permission to update the database.

## Check the connection

Run the command from **Copy psql**, with your password in place of `<password>`. Its prompt
starts with `defaultdb`, and the line `SSL connection` above it confirms that the
connection is encrypted.

If psql fails to connect from the internet, check that the address you connect from is in the IP
allowlist. For other messages, see
[Troubleshooting TIR DBaaS](/tir/tir-dbaas/troubleshooting/tir-dbaas/). To let more people and apps
in, create their users with SQL and give each one its own password; see
[Reset a user's password](/tir/tir-dbaas/how-to/reset-a-user-password/#add-another-user).