Configurer le PostgreSQL connecteur
Three things decide whether a PostgreSQL connection works: PostgreSQL letting the Agent’s computer in, the Use SSL tick box, and the right login. This page covers each, plus every hosted provider card in the Portal.
Ce que vous obtiendrez
A PostgreSQL connection in Agents de données ce test Connecté, with the databases you want ticked, ready for Excel, Google Sheets, an AI assistant or the REST API. The Agent sends your queries straight to PostgreSQL and only ever reads.
Ce dont l'agent a besoin
A computer that can reach PostgreSQL
The Agent connects from the computer it is installed on, not from your browser. The PostgreSQL driver is built into the Agent, so there is nothing else to install. No Agent yet? Installer l'agent sur Windows d'abord.
A host, a port and a login
The server’s name or address, its port (usually 5432), and a username and password. A login that can only read is best: create a read-only database user. You do not need the database name yet; you pick it after the test.
A way in
Out of the box PostgreSQL only answers programs on its own computer. Another computer needs two settings changed and the port open (ci-dessous). Cloud providers have an allow-list instead (ci-dessous).
Ajouter la connexion
The easiest way round most of this page. If PostgreSQL runs on a server in your office and you are allowed to install programs on it, install the Agent on that server and type localhost as the host. The remote-access settings and the firewall then do not apply. localhost always means the Agent’s computer, never the computer you are browsing on.
-
Pick the card
Ouvrir Agents de données (sous Données in the top menu) and click Ajouter un connecteur on your Agent. For a PostgreSQL you or your company runs, choose PostgreSQL. If your database is with a cloud provider that has its own card (Supabase, Neon, Amazon RDS and the rest), choose that card instead and follow its section ci-dessous.
-
Fill in the five boxes
- Hôte
- The server’s name or address, as seen from the Agent’s computer, such as 192.168.1.20 ou db01. Not sure? Find the host and port.
- Port
- Starts at 5432. Change it only if your server uses another port.
- Nom d'utilisateur
- The read-only login, for example lecteur qs.
- Mot de passe
- That login’s password.
- Use SSL
- Ticked to start with. A PostgreSQL on your own network often has encryption switched off; the test then tells you to untick it (details).
-
Click Test connection
A green Connecté means the Agent signed in and opened a database. An amber Signed in avec No database opened yet. Name it on the next step. is not the success it sounds like; read the remote-access section before typing a name. Anything in red: find the message in Test échoué ?
-
Tick your databases and create the connector
The next screen asks Which databases do you want to work with? Tick the ones with your tables, click Suivant à travers Data realm (already chosen for you), and finish with Créer un connecteur. What this screen shows.
If PostgreSQL runs on your own server
Find the host and port
Ask yourself where PostgreSQL runs, compared with the Agent:
| Where PostgreSQL is | What to type in Host |
|---|---|
| The same computer as the Agent | localhost |
| Another computer in the office | Its name or its address on the office network, such as 192.168.1.20 |
| A cloud provider | The host from the provider’s console; see your provider |
To read it from a tool that already connects:
- pgAdmin: in the tree on the left, right-click your server and choose Propriétés. On the Connexion tab, Host name/address is your Host and Port is your Port. If it says localhost and pgAdmin is on a different computer from the Agent, use that computer’s address instead (see step 3 of the next section for how to find it).
- On the PostgreSQL server itself, run this in any query window (pgAdmin’s Query Tool, le SQL Shell (psql) window installed with PostgreSQL on Windows, or sudo -u postgres psql on Linux):
SHOW port;
It answers with a one-line table holding the port, usually 5432.
If the Agent is on a different computer from PostgreSQL
PostgreSQL refuses other computers until two files say otherwise: postgresql.conf decides whether it listens to the network at all, and pg_hba.conf decides which computers and logins it lets in. Then the server’s firewall has to let port 5432 through.
What a missing pg_hba.conf line looks like today. You might expect a clear refusal. Instead the test shows an amber Signed in, the words No database opened yet. Name it on the next step. and the Agent’s message Login succeeded, but no database could be opened (tried postgres, template1). Enter the database name. If you then type your database name and click Vérifier, it says <name> doesn't exist or this login can't open it. Despite “Login succeeded”, this is almost always pg_hba.conf turning the Agent away: PostgreSQL refuses before it checks the password, and the Agent currently mistakes that refusal for a database problem. We are fixing the message. Follow the steps below.
Not comfortable with this? Ask whoever looks after your database or server to “allow remote connections from the Agent’s computer in postgresql.conf and pg_hba.conf, and open port 5432”, or reply to support and we will do it with you.
-
Find the two files
On the PostgreSQL server, open a query window as the PostgreSQL user (pgAdmin’s Query Tool, ou sudo -u postgres psql on Linux; how, step by step) and run these one at a time:
Run each, note the answerSHOW config_file; SHOW hba_file;
Each answers with a full path. On Windows both are usually in C:\Program Files\PostgreSQL\17\data\ (the number is your version); on Ubuntu or Debian, in /etc/postgresql/17/main/. Write both down.
-
Make PostgreSQL listen to the network
Ouvrir postgresql.conf in a text editor started as administrator (Windows: Start, type Notepad, right-click it, Run as administrator, puis File → Open and set the file-type box to All Files; Linux: sudo nano and the path). Find the line that starts listen_addresses. If it reads 'localhost' or starts with #, replace the whole line with the one below, then save.
The line in postgresql.conflisten_addresses = '*'
Nothing changes yet: PostgreSQL reads this line only when it restarts (step 5).
-
Find the Agent computer’s address
On the computer where the Agent is installed, click Start, type cmd, ouvrir Command Prompt, type ipconfig et presse Enter. The line IPv4 Address shows something like 192.168.1.25. The first three numbers, here 192.168.1, are your office network.
-
Let the Agent in through pg_hba.conf
Ouvrir pg_hba.conf the same way. Near the bottom are lines starting hôte; note the last word on them, usually scram-sha-256 (older servers say md5). Add this line at the very end, with your network’s first three numbers, your login and that same last word, then save:
Add at the end of pg_hba.confhost all qs_reader 192.168.1.0/24 scram-sha-256
Read it as: a network connection (hôte), to any database (tous), as lecteur qs, from any computer on 192.168.1.*, with a password. To allow only the Agent’s computer, write its full address with /32, such as 192.168.1.25/32. If the line names one database instead of tous, the Agent can open only that one.
-
Restart PostgreSQL
Windows: cliquez Start, type Services, ouvrez le Services app, find the entry whose name starts with postgresql-x64-, right-click it and choose Restart. Its Statut goes blank for a moment and comes back as Running. Linux: type the line below; it prints nothing when it works.
Linux: type this, then press Entersudo systemctl restart postgresql
If PostgreSQL does not come back (Status stays blank, or the command prints failed), a typo crept into one of the files. Compare your lines with the ones above, save, and restart again.
-
Open port 5432 on the server
Windows: follow Open a firewall port on Windows for TCP 5432. Ubuntu with the ufw firewall switched on: type this, with your network; it answers Rule added.
Linux (ufw): type this, then press Entersudo ufw allow from 192.168.1.0/24 to any port 5432 proto tcp
-
Test again in the Portal
De retour dans le formulaire de connecteur, cliquez Test de connexion. Connecté means you are through. If it now says Connection failed: SSL connection requested. No SSL enabled connection from this host is configured., untick Use SSL and test again (pourquoi). If it says Connection failed: Failed to connect to and the address, the port is still closed or PostgreSQL did not restart: check steps 5 and 6.
If any of this does not match what you see, stop and reply to our support email with a photo of the screen. We will walk you through it.
If the test mentions SSL: the Use SSL tick box
Use SSL starts ticked. Ticked, the Agent insists on an encrypted connection and gives up if the server cannot provide one. PostgreSQL’s own default is encryption switched off, and many installs, especially on Windows, never turn it on. Against such a server the test says:
Connection failed: SSL connection requested. No SSL enabled connection from this host is configured.
Not comfortable with this? It is one tick box and changes nothing on your server. If you are unsure, reply to support with a photo of the message.
-
Untick Use SSL
In the connector form, click the Use SSL box so the tick disappears. The earlier test result clears; that is normal.
-
Réessayer
Cliquez sur Test de connexion. You see Connecté, or the next problem in line, usually the amber Signed in of a missing pg_hba.conf line (fix it here). The SSL message always comes first because encryption is agreed before anything else.
Is unticking safe? On your own network, yes. Unticked does not mean “never encrypt”: the Agent still encrypts whenever the server offers it, and only falls back to a plain connection when it does not. There is therefore no message that means “tick it” on the PostgreSQL card. Ticked is for when you want the test to fail rather than ever connect unencrypted, which is right for anything that crosses the internet.
Cloud providers. For Supabase, Neon, Crunchy Bridge, Azure PostgreSQL, DigitalOcean, Aiven, Render, Railway, Heroku, Nile, PlanetScale, Prisma, Koyeb, Timescale, IBM Cloud, Xata, Vultr and OVHcloud the Agent forces encryption whatever the box says, because they require it. On Amazon RDS, Google Cloud SQL, AlloyDB, Fly.io, OCI and Scaleway the box is obeyed: leave it ticked for a direct connection, and untick it only when you connect through a proxy program running on the Agent’s computer (the provider sections say when).
If any of this does not match what you see, stop and reply to our support email with a photo of the screen. We will walk you through it.
After a green test: choosing the databases
There is no Database box on the PostgreSQL form. After Connecté, the Agent lists the databases on the server and the next screen asks Which databases do you want to work with? with the line We capture the schema of each one you tick, up to 5.
- The list. Tick each database that holds your tables. If the server has exactly one database of your own, it is already ticked. Entries marked system (such as template1) hold server settings, not your data, and are hidden behind Show … system databases. The first ticked database is the Primary, used when a query does not name one. Rediscover asks the Agent for the list again.
- A typed name. If the login cannot list databases, or after an amber Signed in, the screen says Signed in, but no database opened. Type the database name and verify it. Type it in Type a database name et cliquez Vérifier: <name> added. means it worked; <name> doesn't exist or this login can't open it. means it did not, and What the agent said opens the reason. PostgreSQL names are case-sensitive here: type it exactly as pgAdmin lists it. If you pasted a connection string that named a database, that name is already in the box.
- Before Next works you may see Tick at least one database. ou Verify <name> or untick it.; both mean the list is not finished yet.
Most cards work this way. Four keep a Base de données box on the form instead, because the connection is pinned to one database: Prisma Postgres (pre-filled PostgreSQL), Xata (Database:branch), and Aiven et Échéancier quand Connection Mode is set to the pool, where the box takes the pool’s name.
If your database is with a cloud provider
Each provider card in Ajouter un connecteur knows that provider’s quirks. Three things are the same for all of them:
- Paste the connection string. Most cards start with a box for the provider’s connection string (a line starting postgres:// ou postgresql://). Paste it and Hôte, Port, Nom d'utilisateur and, where the string carries it, Mot de passe fill themselves in. A password still shown as a placeholder in square brackets, like [YOUR-PASSWORD], is left out on purpose: type the real one in Mot de passe. The pasted line is read in your browser only and is never saved or sent; only the filled-in boxes are.
- Allow the Agent’s address. Many providers keep a list of addresses allowed to connect. The address they need is the internet address of the network the Agent’s computer is on, not your office’s 192.168 address. The simple way to get it right: open the provider’s console in a browser on the Agent’s computer and use its “my current IP” button there. When the list is missing the Agent, the test runs for about 30 seconds and ends Connection failed: Failed to connect to ….
- Use SSL. Leave it ticked unless the section below says otherwise (pourquoi).
Red text under a box before you test comes from the card itself; the section for your provider quotes it. If your provider has no card, use the PostgreSQL card with the host, port, username and password from its console.
Supabase
Utiliser le Session pooler connection, not the direct one: Supabase’s direct address works only over IPv6 unless the project has paid for the IPv4 add-on, and most office networks are IPv4.
Not comfortable with this? Ask whoever set up the Supabase project for the Session pooler connection string and the database password, or reply to support.
-
Open the Connect dialog
Dans le Supabase dashboard, open your project and click Connecter at the top of the page. A dialog lists the ways to connect.
-
Copy the Session pooler string
Choisir Session pooler and copy its string. It looks like postgresql://postgres.abcdefghijklmnopqrst:[YOUR-PASSWORD]@aws-0-eu-west-1.pooler.supabase.com:5432/postgres. The part after postgres. is your project ref, and the host may start aws-1- au lieu de aws-0-; copy it rather than typing it.
-
Paste it into the Supabase card
Dans Ajouter un connecteur choisir Supabase and paste into Connection String (paste from Supabase). Connection Mode switches to Session Pooler (IPv4, port 5432) et Hôte, Port, Nom d'utilisateur et Project Ref fill in. Mot de passe stays empty, because the string only holds the placeholder.
-
Type the database password
C'est le base de données password chosen when the project was created, not the password or GitHub login you use for the Supabase website. Supabase cannot show it again. If nobody has it, reset it in the Supabase dashboard on the project’s Database Settings page (Supabase’s instructions); anything else using the old password stops working until you update it there too.
-
Test de connexion
Connecté, then the database list: PostgreSQL is your Supabase database, so tick it. If your project restricts addresses (Network Restrictions in Database Settings), add the Agent’s internet address there first.
What the card and the Agent say when something is off:
- Connection failed: could not reach the Supabase direct host 'db.….supabase.co'. Supabase direct connections are IPv6-only unless the project has the IPv4 add-on. You used the direct string. Go back to step 2 and copy the Session pooler one.
- Connection failed: password authentication failed. Note this is the DATABASE password, not your Supabase dashboard (GitHub/SSO) login… Step 4: the password is wrong or is your website login. The message says to reset it in the Connect dialog; Supabase’s own instructions put the reset on Database Settings.
- That looks like the [YOUR-PASSWORD] placeholder; paste your actual database password ou The pasted string contains [YOUR-PASSWORD]; enter your actual database password here: type the real password in Mot de passe.
- Pooler connections use the dotted username format: postgres.<project-ref>: the username must be postgres. plus your project ref. Direct connections use the plain username (e.g. postgres), not the dotted pooler format is the opposite case.
- Session pooler uses the aws-0-<region>.pooler.supabase.com host; for db.<project-ref>.supabase.co select Direct Connection mode, Port 6543 is the transaction pooler; select Transaction Pooler mode or use port 5432, Transaction pooler uses port 6543: the mode, host and port disagree. Pasting the Session pooler string again puts all three right.
- Not a postgresql:// connection string; copy the URI from the Supabase Connect dialog: you pasted something else, such as the project URL or an API key.
If any of this does not match what you see, stop and reply to our support email with a photo of the screen. We will walk you through it.
Néon
In the Neon console click Connecter; the Connect to your branch window shows the connection string, password included. Paste it into Connection String (paste from Neon). Avec Connection pooling on, the host contains -pooler and the card’s Connection Mode devient Pooled Endpoint; either mode works. Neon pauses idle databases, so the first test after a quiet spell can take a few seconds. Forgotten password: Roles, puis Reset password on the role. If you use Neon’s IP Allow (Settings → Networking), add the Agent’s address. Card messages: Pooled endpoints have a -pooler suffix in the hostname … this looks like a direct host et This is the pooled (-pooler) host; select Pooled Endpoint mode or remove the -pooler suffix for a direct connection mean the mode and host disagree; paste the string again. (Neon: connect from any app)
Rendre
On the database’s page in Render, open the Connecter menu and copy the Externe connection string, not the Internal one: the internal address only works for services inside Render, so the Agent can never reach it. Paste it into External Connection String (paste from the Render dashboard). Render’s access control (the Networking section of the database’s Info page) allows every address by default; if you have narrowed it, add the Agent’s. (Render: connecting to Postgres)
Heroku Postgres
Copy the URL DE LA BASE DE DONNÉES config var from your app’s Paramètres tab in Heroku (or run heroku config:get DATABASE_URL -a your-app) and paste it into DATABASE_URL (paste from heroku config or the dashboard). The trap is later, not now: Heroku changes these credentials on its own during maintenance and when they are rotated, so a connector that worked for months can start failing with password authentication failed. When that happens, copy the new URL DE LA BASE DE DONNÉES, paste it into the connector’s settings, and click Save changes. (Heroku: connecting to Heroku Postgres)
DigitalOcean
In DigitalOcean open Bases de données, your cluster, then Détails de connexion sur le Aperçu. Choose Public network et le chaîne de connexion format, click Copie, and paste into Connection String (paste from the DigitalOcean control panel). The string includes the real password. Then, on the cluster’s Accès au réseau tab, Add Trusted Sources with the Agent’s internet address (from the Agent’s computer, My current IP address does it). Port 25060 is direct and 25061 a connection pool; the card says Port 25061 is a connection pool; select Connection Pool mode or use port 25060 if they disagree. (DigitalOcean: connect to PostgreSQL)
Aiven
Copy the Service URI from the service’s Aperçu in the Aiven console (Quick connect) and paste it into Service URI (paste from the Aiven console). Aiven gives every service its own port, so never assume 5432; the card refuses a blank one with Port is required – Aiven assigns one per service; copy it from the console. A connection pool has a different port again: set Connection Mode à Connection Pool, paste the pool’s URI, and put the pool’s name in Base de données. The allow-list (Set IP address allowlist under the service’s Cloud and network settings) is open to all by default. (Aiven: get started)
Chemin de fer
Railway databases are private until you switch on public access: in the database service’s Settings → Networking, add public access. Railway then creates a TCP proxy address (like shuttle.proxy.rlwy.net:15140) and fills the URL_PUBLIC_DE_LA_BASE_DE_DONNÉES variable. Paste that into Public Connection String (DATABASE_PUBLIC_URL). The other URL, with .chemin de fer.interne in it, only works inside Railway; the card says That is the private-network hostname; use the public TCP-proxy host from DATABASE_PUBLIC_URL. The proxy has its own port, so copy it from the URL. Railway bills the proxy’s traffic as egress. (Railway: PostgreSQL)
Fly.io Postgres
Fly.io Managed Postgres sits on Fly’s private network and cannot be reached from the internet. The Agent gets in through Fly’s proxy, running on the Agent’s computer: with the fly command-line tool installed and signed in there, run proxy de consommation de carburant and leave it running. In the Fly.io Postgres card set Hôte à 127.0.0.1, Port to the local port the proxy prints, Nom d'utilisateur (starts as utilisateur de Fly) and the password from the cluster’s Connexion tab, and untick Use SSL, as the card’s own note says. The card refuses .internal addresses: That is a Fly private-network hostname… The connector works only while the proxy runs, so this suits an always-on computer. (Fly.io: create and connect)
Échéancier
In the Tiger (Timescale) console open Services, your service, Connecter, puis More details for the host, port and username. The password is shown once, when the service is created, in the downloaded <service name>-credentials.txt file; if it is lost, use Forgot your password? in the console. Ports are unusual and per service (often around 30000), and the pooler has a different one; copy whichever you use and set Connection Mode to match (a pool also needs its name in Base de données). If you have an IP allow list applied to the service, add the Agent’s address. (Tiger Data: find connection details)
Pont croustillant
In the Crunchy Bridge dashboard open your cluster’s Connexion tab, pick the role, choose the URL format and paste it into Connection String (paste from Crunchy Bridge). Port 5432 is direct and 5431 the built-in PgBouncer; the card says Port 5431 is the PgBouncer pool; select PgBouncer Pool mode or use port 5432 when they disagree. The cluster firewall (Networking) starts open to all addresses; if you replaced those rules with your own, include the Agent’s address. (Crunchy Bridge: connecting)
AlloyDB
AlloyDB instances have only a private address by default, inside your Google Cloud network, which an Agent in your office cannot reach. Two ways in: switch on Enable Public IP on the instance and add the Agent’s internet address to its authorised external networks, then type the public IP in Instance IP address avec Use SSL ticked; or run the AlloyDB Auth Proxy on the Agent’s computer, type 127.0.0.1, and untick Use SSL (the proxy encrypts the link itself, and the card’s note says to turn it off). If the instance only has a private address and you do not use the proxy, the Agent has to run on a machine inside that Google Cloud network. (AlloyDB: connect using public IP)
OCI PostgreSQL
Oracle says plainly that OCI Database with PostgreSQL endpoints “aren’t directly accessible from the internet”. The practical answer is to install the Agent on a compute instance inside the same OCI network (VCN), then type the database system’s private address or FQDN (from Databases → PostgreSQL → DB Systems, your system, Détails de connexion) into Private IP or FQDN. A Bastion session also works but expires, which breaks the connector. Keep Use SSL ticked unless your DB system has TLS turned off. (Oracle: connecting to a database)
Scaleway
Scaleway shows an IP address and a port, not a host name. In the Scaleway console open Databases → PostgreSQL and MySQL, pick the region and your instance, and copy the IP and port from its information section into the card’s IP address et Port (the port is per instance, not 5432). The default database is base de données RDB. Le Allowed IPs tab starts open to all; if you narrowed it, add the Agent’s address with Add allowed IP. (Scaleway: connect to a Database Instance)
OVHcloud
OVHcloud is the one provider here that refuses every address until you add one: “by default, a Public Cloud Databases service does not accept any connection from the outside world.” In the OVHcloud Control Panel open Bases de données, your service, the Configuration tab, and in the IPs section add the Agent’s internet address (Current IP does it from the Agent’s computer). Then copy the service URI and paste it into Service URI (paste from the OVHcloud manager); the user is usually avnadmin and the port is per service. (OVHcloud: prepare for incoming connections)
Vultr
In Vultr open Products → Databases, your database, and under Aperçu use Copy Connection String dans Détails de connexion; paste it into Connection String (paste from the Vultr portal). The port is not 5432 (the card refuses a blank one: Port is required – Vultr assigns one per cluster; copy it from the portal). Trusted Sources allows all addresses until you edit it; if you have, add the Agent’s. (Vultr: connection details)
Koyeb Postgres
In Koyeb open the Bases de données tab, your database service, then Détails de connexion; copy the psql connection string and paste it into Connection String (paste from the Koyeb console). Database hosts end in .pg.koyeb.app; an app address gets That looks like a Koyeb app hostname; database hosts end in .pg.koyeb.app. A password changed inside PostgreSQL is not reflected in the Koyeb console; reset it from the service’s Roles tab instead. (Koyeb: databases)
Nil
In the Nile console open your database, then settings, connections, click the Postgres icon and Generate credentials. Copy the connection string straight away (the password is shown once) and paste it into Connection String (paste from the Nile console). The username is a generated id, not a name you chose. (Nile: psql)
IBM Cloud PostgreSQL
A new IBM Cloud Databases for PostgreSQL deployment has an admin user with no password you can use: set one first (IBM’s docs show the command ibmcloud cdb deployment-user-password). The connection string is on the deployment’s Aperçu, in the Points d'extrémité panel; use the public endpoint and paste it into Connection String (paste from the IBM Cloud dashboard). The port is per deployment, usually in the 30000s. (IBM Cloud: connection strings)
Prisma Postgres
In the Prisma Console open your database, Connect to your database, puis Generate new connection string, et copiez le direct one, which starts postgres:// and ends @db.prisma.io:5432/?sslmode=require. Paste it into Direct Connection String (paste from the Prisma Console). The other kind, starting prisma+postgres://, is refused with That is the Prisma Accelerate URL – generate the DIRECT TCP connection string instead. The string has no database name, so the card keeps a Base de données box set to PostgreSQL; leave it. A company firewall must allow outgoing port 5432 to db.prisma.io. (Prisma: direct connections)
PostgreSQL à l'échelle planétaire
In PlanetScale click Connecter and create a role; copy the credentials at once, because PlanetScale does not show them again. Passwords start pscale_pw_ and usernames carry a dot and an id; the card checks with PlanetScale usernames use the dotted format: postgres.<database-id>. The card starts on PSBouncer Pool with port 6432; 5432 is direct. Both a postgresql:// string and PlanetScale’s host=… port=… form paste into Connection String (paste from the PlanetScale console). (PlanetScale: connecting)
Xata
Xata maps the boxes differently: Workspace ID (username), API key (password) (it starts xau_) et Database:branch, such as mydb:main. Paste Xata’s postgresql:// string into Connection String (paste from Xata) and the three fill in; a bare database name gets Xata expects database:branch (e.g. mydb:main). We could not confirm the current Xata console screens; if they do not match, send us a photo.
Azure PostgreSQL
Azure Database for PostgreSQL lets no address in by default. In the Azure portal open your server, then Networking sous Paramètres, cliquez Add current client IP address (from a browser on the Agent’s computer, so it adds the right one) and Économiser; changes can take up to five minutes. Allow public access from any Azure service within Azure to this server does not cover an Agent in your office. Copy Server name et Administrator login from the server’s Aperçu; flexible server usernames have no @servername ending, and the card says Flexible server usernames have no @servername suffix; use the plain username if you add one. Port 6432 is the optional built-in PgBouncer. (Microsoft: add firewall rules)
Amazon RDS
In the RDS console open Bases de données, your instance, and the Connectivité et sécurité tab; copy the Point de terminaison (with :5432 if you like) into Endpoint or Connection String (paste from the RDS console), which also sets Database Engine to PostgreSQL. RDS lets nothing in by default, and two things must both be true: the instance has Public accessibility réglé à Oui, and its VPC security group has an inbound rule for port 5432 from the Agent’s address (choose My IP as the source, from the Agent’s computer). Missing either one gives Failed to connect to after about 30 seconds. Keep Use SSL ticked: RDS for PostgreSQL 15 and later refuses unencrypted connections. (AWS: connecting to RDS for PostgreSQL)
Google Cloud SQL
The Google Cloud SQL card has no paste box; type the instance’s public IP into Instance IP address. For that to work the instance needs Public IP switched on (Connections → Networking) and the Agent’s internet address under Authorized networks, puis Économiser. The alternative is the Proxy d'authentification Cloud SQL on the Agent’s computer: type 127.0.0.1 and untick Use SSL, as the card’s note says (the proxy encrypts the link itself). If PostgreSQL is also installed on that computer, the proxy needs a port other than 5432. (Google: authorized networks)
Test échoué ?
The message under the test result tells you which of these it is. The Agent’s messages start Connection failed:; the database names and addresses in yours will differ.
| Message | Cause | Réparer |
|---|---|---|
| SSL connection requested. No SSL enabled connection from this host is configured. | Use SSL is ticked and the server has encryption off. | Untick Use SSL and test again (why it is safe). |
| Amber Signed in avec Login succeeded, but no database could be opened (tried postgres, template1). Enter the database name. | Almost always pg_hba.conf has no line for the Agent’s computer. Rarely, the server really has no database the login may open. | Steps 1, 3, 4 and 5 of the remote-access walkthrough, then test again before typing any name. |
| Login succeeded, but database 'sales' can't be opened by this login and no fallback database could be opened (tried sales, postgres, template1). | The same pg_hba.conf refusal, seen after you typed a name. | As above: add the pg_hba.conf line and restart. |
| Failed to connect to 192.168.1.20:5432 | Nothing let the Agent through: PostgreSQL listens only to itself, the port is closed, the service is stopped, the host or port is wrong, or (cloud) the Agent’s address is not on the allow-list. Instant means refused; after about 30 seconds means blocked. | Self-hosted: listen_addresses, restart, the firewall, et test the port. Cloud: your provider’s allow-list in its section. |
| 28P01: password authentication failed for user "qs_reader" | Wrong password, or no login of that name (PostgreSQL says the same for both). On Heroku, credentials that were rotated. | Retype the password, check the username, or reset it (create the read-only login). Heroku: paste the new DATABASE_URL. |
| password authentication failed. Note this is the DATABASE password, not your Supabase dashboard (GitHub/SSO) login… | Supabase: the website login or an old password was typed. | Use or reset the database password. |
| could not reach the Supabase direct host … IPv6-only unless the project has the IPv4 add-on | Supabase direct connection from an IPv4 network. | Use the Session pooler string. |
| No such host is known. (on a Linux Agent, Name or service not known) | The host name is misspelt or unknown to the Agent’s computer. | Copy the host again (where to find it), or use the server’s address instead of its name. |
| Database 'sales' does not exist on this server. | Typo, or different capital letters. | Type the name exactly as pgAdmin lists it (the database step). |
| This login can't open database 'sales'. | The login lacks permission on that database, or the pg_hba.conf line names a different database. | GRANT CONNECT, or write tous dans the pg_hba.conf line. |
| <name> doesn't exist or this login can't open it. (after Verify) | One of the three rows above. | Ouvrir What the agent said and match it here. |
| Red text under a box before you test | The provider card spotted a mismatch (wrong mode, port, username shape, or a placeholder password). | Your provider’s section quotes each one; pasting the provider’s string again usually clears it. |
| Le Test de connexion button is greyed out and hovering it says Agent is offline — start the agent to test the connection | The Agent is not connected. | Is the Agent online? |
Ensuite : utiliser les données
- PostgreSQL vers Excel
- PostgreSQL vers Google Sheets
- PostgreSQL in Claude and other AI assistants (MCP)
- PostgreSQL as a REST API
Guides associés
Setup trouble?
- Agent shows Offline, or Test connection and Browse are greyed out? Check that the Agent is online → Is the Agent online?

