Set up the PostgreSQL connector

Connector setup · PostgreSQL

設定する PostgreSQL コネクタ

Three things decide whether a PostgreSQL connection works: PostgreSQL letting the Agent’s computer in, the Use SSL tick box, and the right login. This page covers each, plus every hosted provider card in the Portal.

約10分 Your own server or a cloud provider 読み取り専用

最終的に手に入るもの

A PostgreSQL connection in データエージェント そのテスト 接続済み, with the databases you want ticked, ready for Excel, Google Sheets, an AI assistant or the REST API. The Agent sends your queries straight to PostgreSQL and only ever reads.

エージェントが必要とするもの

接続を追加する

1. Pick the card

   開く データエージェント （下 データ in the top menu) and click コネクタを追加する on your Agent. For a PostgreSQL you or your company runs, choose PostgreSQL. If your database is with a cloud provider that has its own card (Supabase, Neon, Amazon RDS and the rest), choose that card instead and follow its section 下に.

2. Fill in the five boxes

   ホスト

   The server’s name or address, as seen from the Agent’s computer, such as 192.168.1.20 または db01. Not sure? Find the host and port.

   ポート

   Starts at 5432. Change it only if your server uses another port.

   ユーザー名

   The read-only login, for example qs_reader.

   パスワード

   That login’s password.

   Use SSL

   Ticked to start with. A PostgreSQL on your own network often has encryption switched off; the test then tells you to untick it (details).

3. Click Test connection

   A green 接続済み means the Agent signed in and opened a database. An amber Signed in と No database opened yet. Name it on the next step. is not the success it sounds like; read the remote-access section before typing a name. Anything in red: find the message in テストは失敗しましたか？

4. Tick your databases and create the connector

   The next screen asks Which databases do you want to work with? Tick the ones with your tables, click 次のページ を通して Data realm (already chosen for you), and finish with コネクタを作成する. What this screen shows.

If PostgreSQL runs on your own server

Find the host and port

Ask yourself where PostgreSQL runs, compared with the Agent:

To read it from a tool that already connects:

• pgAdmin: in the tree on the left, right-click your server and choose プロパティ. On the 繋がり tab, Host name/address is your Host and ポート is your Port. If it says ローカルホスト and pgAdmin is on a different computer from the Agent, use that computer’s address instead (see step 3 of the next section for how to find it).
• On the PostgreSQL server itself, run this in any query window (pgAdmin’s Query Tool、 SQL Shell (psql) window installed with PostgreSQL on Windows, or sudo -u postgres psql on Linux):

SHOW port;

It answers with a one-line table holding the port, usually 5432.

If the Agent is on a different computer from PostgreSQL

PostgreSQL refuses other computers until two files say otherwise: postgresql.conf decides whether it listens to the network at all, and pg_hba.conf decides which computers and logins it lets in. Then the server’s firewall has to let port 5432 through.

What a missing pg_hba.conf line looks like today. You might expect a clear refusal. Instead the test shows an amber Signed in, the words No database opened yet. Name it on the next step. and the Agent’s message Login succeeded, but no database could be opened (tried postgres, template1). Enter the database name. If you then type your database name and click 確認する, it says <name> doesn't exist or this login can't open it. Despite “Login succeeded”, this is almost always pg_hba.conf turning the Agent away: PostgreSQL refuses before it checks the password, and the Agent currently mistakes that refusal for a database problem. We are fixing the message. Follow the steps below.

1. Find the two files

   On the PostgreSQL server, open a query window as the PostgreSQL user (pgAdmin’s Query Tool、または sudo -u postgres psql on Linux; how, step by step) and run these one at a time:

   Run each, note the answer

   SHOW config_file;
   SHOW hba_file;

   Each answers with a full path. On Windows both are usually in C:\Program Files\PostgreSQL\17\data\ (the number is your version); on Ubuntu or Debian, in /etc/postgresql/17/main/. Write both down.

2. Make PostgreSQL listen to the network

   開く postgresql.conf in a text editor started as administrator (Windows: Start, type Notepad, right-click it, Run as administrator、そして File → Open and set the file-type box to All Files; Linux: sudo nano and the path). Find the line that starts listen_addresses. If it reads 'localhost' or starts with #, replace the whole line with the one below, then save.

   The line in postgresql.conf

   listen_addresses = '*'

   Nothing changes yet: PostgreSQL reads this line only when it restarts (step 5).

3. Find the Agent computer’s address

   On the computer where the Agent is installed, click Start, type cmd、 開ける Command Prompt, type ipconfig そして押す Enter. The line IPv4 Address shows something like 192.168.1.25. The first three numbers, here 192.168.1, are your office network.

4. Let the Agent in through pg_hba.conf

   開く pg_hba.conf the same way. Near the bottom are lines starting ホスト; note the last word on them, usually scram-sha-256 (older servers say md5). Add this line at the very end, with your network’s first three numbers, your login and that same last word, then save:

   Add at the end of pg_hba.conf

   host    all    qs_reader    192.168.1.0/24    scram-sha-256

   Read it as: a network connection (ホスト), to any database (すべて), as qs_reader, from any computer on 192.168.1.*, with a password. To allow only the Agent’s computer, write its full address with /32, such as 192.168.1.25/32. If the line names one database instead of すべて, the Agent can open only that one.

5. Restart PostgreSQL

   Windows: クリック Start, type サービス開く サービス app, find the entry whose name starts with postgresql-x64-, right-click it and choose Restart. Its ステータス goes blank for a moment and comes back as Running. Linux: type the line below; it prints nothing when it works.

   Linux: type this, then press Enter

   sudo systemctl restart postgresql

   If PostgreSQL does not come back (Status stays blank, or the command prints failed), a typo crept into one of the files. Compare your lines with the ones above, save, and restart again.

6. Open port 5432 on the server

   Windows: follow Open a firewall port on Windows for TCP 5432. Ubuntu with the ufw firewall switched on: type this, with your network; it answers Rule added.

   Linux (ufw): type this, then press Enter

   sudo ufw allow from 192.168.1.0/24 to any port 5432 proto tcp

7. Test again in the Portal

   コネクタフォームに戻り、クリックします 接続テスト. 接続済み means you are through. If it now says Connection failed: SSL connection requested. No SSL enabled connection from this host is configured., untick Use SSL and test again (なぜ). If it says Connection failed: Failed to connect to and the address, the port is still closed or PostgreSQL did not restart: check steps 5 and 6.

If the test mentions SSL: the Use SSL tick box

Use SSL starts ticked. Ticked, the Agent insists on an encrypted connection and gives up if the server cannot provide one. PostgreSQL’s own default is encryption switched off, and many installs, especially on Windows, never turn it on. Against such a server the test says:

Connection failed: SSL connection requested. No SSL enabled connection from this host is configured.

1. Untick Use SSL

   In the connector form, click the Use SSL box so the tick disappears. The earlier test result clears; that is normal.

2. もう一度テストしてください

   クリック 接続テスト. You see 接続済み, or the next problem in line, usually the amber Signed in of a missing pg_hba.conf line (fix it here). The SSL message always comes first because encryption is agreed before anything else.

Is unticking safe? On your own network, yes. Unticked does not mean “never encrypt”: the Agent still encrypts whenever the server offers it, and only falls back to a plain connection when it does not. There is therefore no message that means “tick it” on the PostgreSQL card. Ticked is for when you want the test to fail rather than ever connect unencrypted, which is right for anything that crosses the internet.

Cloud providers. For Supabase, Neon, Crunchy Bridge, Azure PostgreSQL, DigitalOcean, Aiven, Render, Railway, Heroku, Nile, PlanetScale, Prisma, Koyeb, Timescale, IBM Cloud, Xata, Vultr and OVHcloud the Agent forces encryption whatever the box says, because they require it. On Amazon RDS, Google Cloud SQL, AlloyDB, Fly.io, OCI and Scaleway the box is obeyed: leave it ticked for a direct connection, and untick it only when you connect through a proxy program running on the Agent’s computer (the provider sections say when).

After a green test: choosing the databases

There is no Database box on the PostgreSQL form. After 接続済み, the Agent lists the databases on the server and the next screen asks Which databases do you want to work with? with the line We capture the schema of each one you tick, up to 5.

• The list. Tick each database that holds your tables. If the server has exactly one database of your own, it is already ticked. Entries marked system (such as template1) hold server settings, not your data, and are hidden behind Show … system databases. The first ticked database is the Primary, used when a query does not name one. Rediscover asks the Agent for the list again.
• A typed name. If the login cannot list databases, or after an amber Signed in, the screen says Signed in, but no database opened. Type the database name and verify it. Type it in Type a database name そしてクリック 確認する: <name> added. means it worked; <name> doesn't exist or this login can't open it. means it did not, and What the agent said opens the reason. PostgreSQL names are case-sensitive here: type it exactly as pgAdmin lists it. If you pasted a connection string that named a database, that name is already in the box.
• Before Next works you may see Tick at least one database. または Verify <name> or untick it.; both mean the list is not finished yet.

Most cards work this way. Four keep a データベース box on the form instead, because the connection is pinned to one database: Prisma Postgres (pre-filled PostgreSQL), ザタ (Database:branch), and アイベン そして タイムスケール いつ Connection Mode is set to the pool, where the box takes the pool’s name.

If your database is with a cloud provider

Each provider card in コネクタを追加する knows that provider’s quirks. Three things are the same for all of them:

• Paste the connection string. Most cards start with a box for the provider’s connection string (a line starting postgres:// または postgresql://). Paste it and ホスト, ポート, ユーザー名 and, where the string carries it, パスワード fill themselves in. A password still shown as a placeholder in square brackets, like [YOUR-PASSWORD], is left out on purpose: type the real one in パスワード. The pasted line is read in your browser only and is never saved or sent; only the filled-in boxes are.
• Allow the Agent’s address. Many providers keep a list of addresses allowed to connect. The address they need is the internet address of the network the Agent’s computer is on, not your office’s 192.168 address. The simple way to get it right: open the provider’s console in a browser on the Agent’s computer and use its “my current IP” button there. When the list is missing the Agent, the test runs for about 30 seconds and ends Connection failed: Failed to connect to ….
• Use SSL. Leave it ticked unless the section below says otherwise (なぜ).

Red text under a box before you test comes from the card itself; the section for your provider quotes it. If your provider has no card, use the PostgreSQL card with the host, port, username and password from its console.

スーパーベース

を使用する。 セッションプーラー connection, not the direct one: Supabase’s direct address works only over IPv6 unless the project has paid for the IPv4 add-on, and most office networks are IPv4.

1. Open the Connect dialog

   では Supabase dashboard, open your project and click 接続する at the top of the page. A dialog lists the ways to connect.

2. Copy the Session pooler string

   選ぶ セッションプーラー and copy its string. It looks like postgresql://postgres.abcdefghijklmnopqrst:[YOUR-PASSWORD]@aws-0-eu-west-1.pooler.supabase.com:5432/postgres. The part after postgres. is your project ref, and the host may start aws-1- の代わりに aws-0-; copy it rather than typing it.

3. Paste it into the Supabase card

   で コネクタを追加する 選ぶ スーパーベース and paste into Connection String (paste from Supabase). Connection Mode switches to Session Pooler (IPv4, port 5432) そして ホスト, ポート, ユーザー名 そして Project Ref fill in. パスワード stays empty, because the string only holds the placeholder.

4. Type the database password

   これは データベース password chosen when the project was created, not the password or GitHub login you use for the Supabase website. Supabase cannot show it again. If nobody has it, reset it in the Supabase dashboard on the project’s Database Settings page (Supabase’s instructions); anything else using the old password stops working until you update it there too.

5. 接続テスト

   接続済み, then the database list: PostgreSQL is your Supabase database, so tick it. If your project restricts addresses (Network Restrictions in Database Settings), add the Agent’s internet address there first.

What the card and the Agent say when something is off:

• Connection failed: could not reach the Supabase direct host 'db.….supabase.co'. Supabase direct connections are IPv6-only unless the project has the IPv4 add-on. You used the direct string. Go back to step 2 and copy the Session pooler one.
• Connection failed: password authentication failed. Note this is the DATABASE password, not your Supabase dashboard (GitHub/SSO) login… Step 4: the password is wrong or is your website login. The message says to reset it in the Connect dialog; Supabase’s own instructions put the reset on Database Settings.
• That looks like the [YOUR-PASSWORD] placeholder; paste your actual database password または The pasted string contains [YOUR-PASSWORD]; enter your actual database password here: type the real password in パスワード.
• Pooler connections use the dotted username format: postgres.<project-ref>: the username must be postgres. plus your project ref. Direct connections use the plain username (e.g. postgres), not the dotted pooler format is the opposite case.
• Session pooler uses the aws-0-<region>.pooler.supabase.com host; for db.<project-ref>.supabase.co select Direct Connection mode, Port 6543 is the transaction pooler; select Transaction Pooler mode or use port 5432, Transaction pooler uses port 6543: the mode, host and port disagree. Pasting the Session pooler string again puts all three right.
• Not a postgresql:// connection string; copy the URI from the Supabase Connect dialog: you pasted something else, such as the project URL or an API key.

ネオン

In the Neon console click 接続する; the Connect to your branch window shows the connection string, password included. Paste it into Connection String (paste from Neon)。 と Connection pooling on, the host contains -pooler and the card’s Connection Mode になる Pooled Endpoint; either mode works. Neon pauses idle databases, so the first test after a quiet spell can take a few seconds. Forgotten password: Roles、そして Reset password on the role. If you use Neon’s IP Allow (Settings → Networking), add the Agent’s address. Card messages: Pooled endpoints have a -pooler suffix in the hostname … this looks like a direct host そして This is the pooled (-pooler) host; select Pooled Endpoint mode or remove the -pooler suffix for a direct connection mean the mode and host disagree; paste the string again. (Neon: connect from any app)

与える

On the database’s page in Render, open the 接続する menu and copy the 外部の connection string, not the Internal one: the internal address only works for services inside Render, so the Agent can never reach it. Paste it into External Connection String (paste from the Render dashboard). Render’s access control (the Networking section of the database’s 情報 page) allows every address by default; if you have narrowed it, add the Agent’s. (Render: connecting to Postgres)

Heroku Postgres

Copy the データベースURL config var from your app’s 設定 tab in Heroku (or run heroku config:get DATABASE_URL -a your-app) and paste it into DATABASE_URL (paste from heroku config or the dashboard). The trap is later, not now: Heroku changes these credentials on its own during maintenance and when they are rotated, so a connector that worked for months can start failing with password authentication failed. When that happens, copy the new データベースURL, paste it into the connector’s settings, and click Save changes. (Heroku: connecting to Heroku Postgres)

デジタルオーシャン

In DigitalOcean open データベース, your cluster, then 接続の詳細 で 概要. Choose Public network そして 接続文字列 format, click コピー, and paste into Connection String (paste from the DigitalOcean control panel). The string includes the real password. Then, on the cluster’s ネットワークアクセス tab, Add Trusted Sources with the Agent’s internet address (from the Agent’s computer, My current IP address does it). Port 25060 is direct and 25061 a connection pool; the card says Port 25061 is a connection pool; select Connection Pool mode or use port 25060 if they disagree. (DigitalOcean: connect to PostgreSQL)

アイベン

Copy the Service URI from the service’s 概要 in the Aiven console (Quick connect) and paste it into Service URI (paste from the Aiven console). Aiven gives every service its own port, so never assume 5432; the card refuses a blank one with Port is required – Aiven assigns one per service; copy it from the console. A connection pool has a different port again: set Connection Mode ～へ Connection Pool, paste the pool’s URI, and put the pool’s name in データベース. The allow-list (Set IP address allowlist under the service’s Cloud and network settings) is open to all by default. (Aiven: get started)

鉄道

Railway databases are private until you switch on public access: in the database service’s Settings → Networking, add public access. Railway then creates a TCP proxy address (like shuttle.proxy.rlwy.net:15140) and fills the データベース公開URL variable. Paste that into Public Connection String (DATABASE_PUBLIC_URL). The other URL, with .鉄道内部 in it, only works inside Railway; the card says That is the private-network hostname; use the public TCP-proxy host from DATABASE_PUBLIC_URL. The proxy has its own port, so copy it from the URL. Railway bills the proxy’s traffic as egress. (Railway: PostgreSQL)

Fly.io ポストグレス

Fly.io Managed Postgres sits on Fly’s private network and cannot be reached from the internet. The Agent gets in through Fly’s proxy, running on the Agent’s computer: with the fly command-line tool installed and signed in there, run 飛行燃費プロキシ and leave it running. In the Fly.io ポストグレス card set ホスト ～へ 127.0.0.1, ポート to the local port the proxy prints, ユーザー名 (starts as フライユーザー) and the password from the cluster’s 繋がり tab, and untick Use SSL, as the card’s own note says. The card refuses .internal addresses: That is a Fly private-network hostname… The connector works only while the proxy runs, so this suits an always-on computer. (Fly.io: create and connect)

タイムスケール

In the Tiger (Timescale) console open サービス, your service, 接続する、そして More details for the host, port and username. The password is shown once, when the service is created, in the downloaded <service name>-credentials.txt file; if it is lost, use Forgot your password? in the console. Ports are unusual and per service (often around 30000), and the pooler has a different one; copy whichever you use and set Connection Mode to match (a pool also needs its name in データベース). If you have an IP allow list applied to the service, add the Agent’s address. (Tiger Data: find connection details)

クランチーブリッジ

In the Crunchy Bridge dashboard open your cluster’s 繋がり tab, pick the role, choose the URL format and paste it into Connection String (paste from Crunchy Bridge). Port 5432 is direct and 5431 the built-in PgBouncer; the card says Port 5431 is the PgBouncer pool; select PgBouncer Pool mode or use port 5432 when they disagree. The cluster firewall (Networking) starts open to all addresses; if you replaced those rules with your own, include the Agent’s address. (Crunchy Bridge: connecting)

AlloyDB

AlloyDB instances have only a private address by default, inside your Google Cloud network, which an Agent in your office cannot reach. Two ways in: switch on Enable Public IP on the instance and add the Agent’s internet address to its authorised external networks, then type the public IP in Instance IP address と Use SSL ticked; or run the AlloyDB Auth Proxy on the Agent’s computer, type 127.0.0.1, and untick Use SSL (the proxy encrypts the link itself, and the card’s note says to turn it off). If the instance only has a private address and you do not use the proxy, the Agent has to run on a machine inside that Google Cloud network. (AlloyDB: connect using public IP)

OCI PostgreSQL

Oracle says plainly that OCI Database with PostgreSQL endpoints “aren’t directly accessible from the internet”. The practical answer is to install the Agent on a compute instance inside the same OCI network (VCN), then type the database system’s private address or FQDN (from Databases → PostgreSQL → DB Systems, your system, 接続の詳細) into Private IP or FQDN. A Bastion session also works but expires, which breaks the connector. Keep Use SSL ticked unless your DB system has TLS turned off. (Oracle: connecting to a database)

スケールウェイ

Scaleway shows an IP address and a port, not a host name. In the Scaleway console open Databases → PostgreSQL and MySQL, pick the region and your instance, and copy the IP and port from its information section into the card’s IP address そして ポート (the port is per instance, not 5432). The default database is rdb. Allowed IPs tab starts open to all; if you narrowed it, add the Agent’s address with Add allowed IP. (Scaleway: connect to a Database Instance)

OVHクラウド

OVHcloud is the one provider here that refuses every address until you add one: “by default, a Public Cloud Databases service does not accept any connection from the outside world.” In the OVHcloud Control Panel open データベース, your service, the 設定 tab, and in the IPs section add the Agent’s internet address (Current IP does it from the Agent’s computer). Then copy the service URI and paste it into Service URI (paste from the OVHcloud manager); the user is usually avnadmin and the port is per service. (OVHcloud: prepare for incoming connections)

ヴァルトル

In Vultr open Products → Databases, your database, and under 概要 use Copy Connection String で 接続の詳細; paste it into Connection String (paste from the Vultr portal). The port is not 5432 (the card refuses a blank one: Port is required – Vultr assigns one per cluster; copy it from the portal). Trusted Sources allows all addresses until you edit it; if you have, add the Agent’s. (Vultr: connection details)

コイエブ・ポストグレス

In Koyeb open the データベース tab, your database service, then 接続の詳細; copy the psql connection string and paste it into Connection String (paste from the Koyeb console). Database hosts end in .pg.koyeb.app; an app address gets That looks like a Koyeb app hostname; database hosts end in .pg.koyeb.app. A password changed inside PostgreSQL is not reflected in the Koyeb console; reset it from the service’s Roles tab instead. (Koyeb: databases)

ナイル川

In the Nile console open your database, then settings, connections, click the Postgres icon and Generate credentials. Copy the connection string straight away (the password is shown once) and paste it into Connection String (paste from the Nile console). The username is a generated id, not a name you chose. (Nile: psql)

IBM Cloud PostgreSQL

A new IBM Cloud Databases for PostgreSQL deployment has an admin user with no password you can use: set one first (IBM’s docs show the command ibmcloud cdb deployment-user-password). The connection string is on the deployment’s 概要, in the エンドポイント panel; use the public endpoint and paste it into Connection String (paste from the IBM Cloud dashboard). The port is per deployment, usually in the 30000s. (IBM Cloud: connection strings)

Prisma Postgres

In the Prisma Console open your database, Connect to your database、そして Generate new connection string、そしてコピーします direct one, which starts postgres:// and ends @db.prisma.io:5432/?sslmode=require. Paste it into Direct Connection String (paste from the Prisma Console). The other kind, starting prisma+postgres://, is refused with That is the Prisma Accelerate URL – generate the DIRECT TCP connection string instead. The string has no database name, so the card keeps a データベース box set to PostgreSQL; leave it. A company firewall must allow outgoing port 5432 to db.prisma.io. (Prisma: direct connections)

PlanetScale Postgres

In PlanetScale click 接続する and create a role; copy the credentials at once, because PlanetScale does not show them again. Passwords start pscale_pw_ and usernames carry a dot and an id; the card checks with PlanetScale usernames use the dotted format: postgres.<database-id>. The card starts on PSBouncer Pool with port 6432; 5432 is direct. Both a postgresql:// string and PlanetScale’s host=… port=… form paste into Connection String (paste from the PlanetScale console). (PlanetScale: connecting)

ザタ

Xata maps the boxes differently: Workspace ID (username), API key (password) (it starts xau_） そして Database:branch, such as mydb:main. Paste Xata’s postgresql:// string into Connection String (paste from Xata) and the three fill in; a bare database name gets Xata expects database:branch (e.g. mydb:main). We could not confirm the current Xata console screens; if they do not match, send us a photo.

Azure PostgreSQL

Azure Database for PostgreSQL lets no address in by default. In the Azure portal open your server, then Networking 下 設定、 クリック Add current client IP address (from a browser on the Agent’s computer, so it adds the right one) and セーブ; changes can take up to five minutes. Allow public access from any Azure service within Azure to this server does not cover an Agent in your office. Copy Server name そして Administrator login from the server’s 概要; flexible server usernames have no @servername ending, and the card says Flexible server usernames have no @servername suffix; use the plain username if you add one. Port 6432 is the optional built-in PgBouncer. (Microsoft: add firewall rules)

Amazon RDS

In the RDS console open データベース, your instance, and the 接続性とセキュリティ tab; copy the 終点 (with :5432 if you like) into Endpoint or Connection String (paste from the RDS console), which also sets Database Engine to PostgreSQL. RDS lets nothing in by default, and two things must both be true: the instance has Public accessibility 設定 はい, and its VPC security group has an inbound rule for port 5432 from the Agent’s address (choose My IP as the source, from the Agent’s computer). Missing either one gives Failed to connect to after about 30 seconds. Keep Use SSL ticked: RDS for PostgreSQL 15 and later refuses unencrypted connections. (AWS: connecting to RDS for PostgreSQL)

Google Cloud SQL

The Google Cloud SQL card has no paste box; type the instance’s public IP into Instance IP address. For that to work the instance needs Public IP switched on (Connections → Networking) and the Agent’s internet address under Authorized networks、そして セーブ. The alternative is the Cloud SQL認証プロキシ on the Agent’s computer: type 127.0.0.1 and untick Use SSL, as the card’s note says (the proxy encrypts the link itself). If PostgreSQL is also installed on that computer, the proxy needs a port other than 5432. (Google: authorized networks)

テストは失敗しましたか？

The message under the test result tells you which of these it is. The Agent’s messages start Connection failed:; the database names and addresses in yours will differ.

次に、データを使用する

• PostgreSQLからExcelへ
• PostgreSQLからGoogleシートへ
• PostgreSQL in Claude and other AI assistants (MCP)
• PostgreSQL as a REST API

関連ガイド

• Create a read-only database user
• Open a firewall port on Windows
• Is the Agent online?
• Windowsにエージェントをインストールする
• すべてのガイド