Managed · PG + MySQL speaks PostgreSQL / MySQL
Connect DigitalOcean Managed Databases to Excel, Sheets and AI
DigitalOcean Managed Databases — PostgreSQL or MySQL. Paste the connection string from the DO control panel.
One connection, every surface
Where your DigitalOcean data can go
Connect DigitalOcean once and the same read-only connection feeds all of these — no second setup, no second copy of the data. 9 of 11 have a step-by-step guide.
DigitalOcean to Excel
Microsoft Excel · Excel add-in
Pull live DigitalOcean results straight into a worksheet and refresh them on demand — desktop Excel, Excel Online, Microsoft 365.
Read the PostgreSQL guideDigitalOcean to Google Sheets
Sheets add-on
Run a saved DigitalOcean query from the sidebar and drop the rows into the sheet. Shared collaborators can refresh it themselves.
Read the PostgreSQL guideDigitalOcean MCP server
Claude, Cursor and MCP clients
Give an AI assistant read-only access to DigitalOcean with the schema it needs to write correct SQL — no credentials in the chat.
Read the PostgreSQL guideDigitalOcean REST API
HTTP endpoint
Publish a DigitalOcean query as an authenticated JSON endpoint any application can call, with an OpenAPI 3.1 spec and ready-made Postman, Insomnia and Hoppscotch collections. No database port is opened.
Read the PostgreSQL guideDigitalOcean to Airtable
Automation platform
Sync DigitalOcean rows into an Airtable base on a schedule, or fetch them inside an Airtable automation script.
Read the PostgreSQL guideDigitalOcean to Baserow
Automation platform
Feed a Baserow table from DigitalOcean over the REST endpoint — self-hosted or Baserow cloud.
Read the PostgreSQL guideDigitalOcean to SeaTable
Automation platform
Keep a SeaTable base current with DigitalOcean data without exporting a file or exposing the database.
Read the PostgreSQL guideDigitalOcean to Smartsheet
Automation platform
Push DigitalOcean results into a Smartsheet grid so plans and reports read from the source system, not last week's export.
Read the PostgreSQL guideDigitalOcean to Anvil
Anvil Works · App platform
Back an Anvil Python app with DigitalOcean through the REST endpoint instead of embedding database credentials in the app.
Read the PostgreSQL guideDigitalOcean to Power BI
Power Query M
Paste the generated Power Query M into the Power BI Advanced Editor and the report reads live DigitalOcean results over HTTPS — no ODBC driver, no database port opened.
How Power BI works no DigitalOcean walkthrough written yetDigitalOcean alerts and reports
Slack · Discord · Email · Webhook
Put a DigitalOcean query on a schedule and have the rows delivered to Slack, Discord, email or a signed webhook — or hold the message until a row count, threshold or percentage change crosses the line you set.
How alerts and reports work no DigitalOcean walkthrough written yetHow it works
5 steps, no inbound firewall change
Install the Network Agent wherever suits you. A DigitalOcean Droplet in the same region keeps the hop short, but any machine with outbound HTTPS works — there is no inbound rule to add.
Paste the connection string from the cluster Overview. It is the only place the real password appears, so pasting it saves you generating a new one.
Check whether you pasted the direct string or the pool. Port 25060 is direct, 25061 is a connection pool, and the card keeps the port and the mode in agreement.
Add a database user with SELECT if you would rather not use doadmin. The card prefills doadmin and defaultdb because that is what a fresh cluster has.
Save, and Microsoft Excel, Google Sheets, Power BI, MCP and REST all read the cluster through the one connection.
Feature deep-dive
What DigitalOcean gives you
Direct or pooled, told apart by the port
DigitalOcean puts connection pools on a different port of the same host, which makes the distinction unusually clean — there is no separate hostname to get wrong.
- Port 25060 is the database itself. Port 25061 is a connection pool, running PgBouncer in transaction mode by default.
- Paste either string and the mode follows the port automatically; you are not asked to know which one you copied.
- Choosing pooled with any other port, or direct on 25061, is rejected in the form with the reason rather than failing later as a timeout.
- For PostgreSQL pools the agent also adapts: it pins prepared statements off, because transaction-mode pooling can hand your next statement to a different backend and a named prepared statement will not be there.
PostgreSQL and MySQL are not treated identically
Both engines are on the one card, but the agent has specific handling for one of them and generic handling for the other. It is worth being straight about which is which.
- DigitalOcean requires TLS for managed databases at its end, whichever engine you use — that is the platform's rule and it applies to both.
- For PostgreSQL the agent additionally requires TLS itself for every .db.ondigitalocean.com host, so a string that lost its sslmode parameter in the clipboard still connects encrypted.
- For MySQL the Use SSL checkbox is what carries it. It is on by default and should stay on; there is no second belt behind that brace.
- The prepared-statement handling on port 25061 is likewise PostgreSQL-specific. A MySQL connection through a pool is a plain connection through a pool.
The password is in the string, and only there
This trips people up on DigitalOcean more than on any other provider, so the card is built around it.
- The control panel shows the password inside the connection string and nowhere else. Pasting the string is the path of least resistance; retyping it from memory is not an option.
- The paste box accepts postgresql:// and mysql:// and rejects anything else with a message telling you where the right one lives.
- A password carrying leading or trailing whitespace is flagged, because it is a common copy artifact and it fails as an unhelpful authentication error.
- doadmin and defaultdb are prefilled because that is what a new cluster ships with — both are yours to change, and a read-only user is the better habit.
-- Read-only, direct or through the pool, same statement
SELECT c.name,
COUNT(o.id) AS orders,
SUM(o.amount) AS revenue
FROM customers AS c
JOIN orders AS o ON o.customer_id = c.id
GROUP BY c.name
ORDER BY revenue DESC;
Shared by every database connector
True of every database connector
- Outbound only — the agent opens one encrypted connection out to Query Streams. No inbound port to forward, no VPN, no IP allowlist, nothing about your database exposed to the internet.
- Credentials stay put — the database username and password live on the machine you installed the agent on. Query Streams never receives them and cannot reach your database on its own.
- Read-only, enforced — one statement at a time, SELECT and friends only. A write is rejected on your own machine before it is ever sent to the server, rather than relying on a permission somebody remembered to set.
- Deploy as many agents as you like — one per site, region or cloud. Every data source they can see arrives in a single dropdown, so nobody has to know which agent hosts what.
What you get once a query is saved
- Share the capability, not the SQL — a colleague or an outside partner can run your query and change its filters without ever seeing the statement behind it.
- Filters from either direction — declare them yourself as @variables, or let the connector spot the literal values already sitting in your WHERE clause and offer those as dropdowns.
- Read it from anywhere — Microsoft Excel, Google Sheets, Power BI, the REST API, AI assistants over MCP, the Query Builder and Nova all read the same saved query.
- Run several at once — five saved queries into five worksheet tabs, streamed concurrently, however large the results.
- Join it to anything else you have connected — another database, a business API, or a folder of files, in one read-only statement.
Cross-source SQL
Join DigitalOcean to the rest of your data
One statement can span DigitalOcean and your other connections at once. Each source runs only the part it can, streams the result back, and the join happens centrally — the sources never talk to each other and nothing is copied anywhere.
3 connections · 3 agents
One statement
-- nothing copied, nothing merged, nothing scheduled
SELECT c.region, COUNT(*) AS orders, SUM(i.amount_due) AS invoiced
FROM do_app.public.orders1 f
JOIN erp_sql.dbo.customers2 c ON c.id = f.customer_id
JOIN billing.stripe.invoices3 i ON i.customer = c.stripe_id
GROUP BY c.region
ORDER BY invoiced DESC;
The three parts are connection, schema and table — and the connection name is whatever you called it. Illustrative columns; your tables will be your tables. Read-only applies to every piece: SELECT, WITH and EXPLAIN only, with a ceiling on how much any one source may hand over for a single query. How federated queries work
Connection details
What DigitalOcean needs
- Host
- db-<cluster>-do-user-<id>-0.<x>.db.ondigitalocean.com
- Ports
- 25060 direct, 25061 for a connection pool — the same host either way
- Engines
- PostgreSQL and MySQL. The connection is saved as the engine you picked; DigitalOcean is kept as the badge
- TLS
- Required by DigitalOcean for both engines. For PostgreSQL the agent also requires it for every .db.ondigitalocean.com host; for MySQL the Use SSL checkbox carries it, on by default
- Pooled behaviour
- On 25061 the agent pins prepared statements off for PostgreSQL, which is what transaction-mode pooling needs. MySQL through a pool gets no special handling
- Defaults
- doadmin and defaultdb, which is what a fresh cluster has
- Password
- Only shown inside the connection string in the control panel — paste the string and it is read out of it
- Paste formats
- postgresql:// and mysql:// URIs from the cluster Overview
- Other DO products
- Managed Redis, Kafka, MongoDB and OpenSearch are not SQL databases and are not connectable here
The port split is the nicest thing about DigitalOcean's design from a connector's point of view. Most providers either hide pooling behind a separate hostname or make it a per-service port you cannot predict; DigitalOcean uses 25060 and 25061 on the same host, every time. That means pasting a string is enough — the mode is inferred, the pooled behaviour is switched on, and there is nothing for you to know in advance.
The asymmetry between the two engines is stated deliberately rather than smoothed over. The agent carries specific handling for DigitalOcean PostgreSQL — required TLS regardless of the checkbox, prepared statements pinned off on the pool port — and carries none for DigitalOcean MySQL, which is served by the general MySQL path. Both work; only one has a second layer of protection behind the setting, and a page that implied otherwise would be describing something the code does not do.
For a cross-source query the qualifier follows the engine. A DigitalOcean PostgreSQL connection you called do_app is written do_app.public.orders; on MySQL the database name takes that slot instead. Either way it joins to a folder of CSVs, an on-premises system of record or a billing API in one read-only statement, with nothing copied and nothing scheduled.
Vendor documentation: www.digitalocean.com
FAQ
Questions about DigitalOcean Managed Databases
Which tools can read DigitalOcean Managed Databases data through Query Streams?
All of them, from one connection: Excel, Google Sheets, MCP, REST API, Airtable, Baserow, SeaTable, Smartsheet, Anvil, Power BI, scheduled alerts and reports. Connect the database once and every surface reads the same read-only connection — there is no per-tool setup and no second copy of the data.
Do I have to open a firewall port to my DigitalOcean Managed Databases database?
No. The Query Streams Network Agent runs inside your network and opens a single outbound encrypted connection. Nothing listens for inbound traffic, no VPN is required, and the database keeps its existing firewall rules.
Can Query Streams change data in DigitalOcean Managed Databases?
No. The agent enforces read-only at the point of execution — one statement at a time, SELECT and friends only. Credentials stay on the agent and are never sent to Query Streams.
What does Query Streams need to connect to DigitalOcean Managed Databases?
A reachable host, a role and its password — the agent carries the driver, so nothing is installed on the database. Host: db-<cluster>-do-user-<id>-0.<x>.db.ondigitalocean.com. Ports: 25060 direct, 25061 for a connection pool — the same host either way. Engines: PostgreSQL and MySQL. The connection is saved as the engine you picked; DigitalOcean is kept as the badge. TLS: Required by DigitalOcean for both engines. For PostgreSQL the agent also requires it for every .db.ondigitalocean.com host; for MySQL the Use SSL checkbox carries it, on by default.
Can I join DigitalOcean Managed Databases to another database in the same query?
Yes — that is a federated query. One statement can reference DigitalOcean Managed Databases and your other connections at once, written as connection.schema.table. Each source runs only the part it can and streams the result back; the join happens centrally, so the sources never connect to each other and nothing is copied or scheduled. Read-only applies to every piece — SELECT, WITH and EXPLAIN only — and there is a ceiling on how much any one source may hand over for a single query. Federated queries are a plan feature; the federated queries page carries the current source and size limits.
Is connecting DigitalOcean Managed Databases different from connecting PostgreSQL?
Only the connection string. DigitalOcean Managed Databases speaks the PostgreSQL wire protocol, so filters, scheduling, sharing, the Excel and Google Sheets add-ons and the MCP server all behave identically. The DigitalOcean card pre-fills the host, port and SSL settings that provider expects.
Is there a DigitalOcean to Excel guide?
Yes — it is the PostgreSQL guide, and it is correct for DigitalOcean Managed Databases as written. DigitalOcean speaks the PostgreSQL wire protocol, so DigitalOcean to Excel, DigitalOcean to Google Sheets and every other destination follow the same steps. The only DigitalOcean-specific part is the connection string, and the DigitalOcean card fills that in for you.
Put DigitalOcean where the work happens
Install the agent, point it at your database, and pick a destination.
Read-only Outbound only Credentials stay on the agent

