# cloider db command reference > Reference for cloider db, to create and manage PostgreSQL, MySQL, MongoDB and Redis databases, connect, run queries, back up, restore, resize and control access. `cloider db` manages your [managed databases](/databases/overview): PostgreSQL, MySQL, MongoDB and Redis. It creates and deletes them, shows how to reach them, prints passwords and CA certificates, connects your local client, opens a client in the browser terminal, runs queries for scripts, lists and restores backups, resizes, renames, toggles SSL, controls who may connect, and shows resource usage. ```text cloider db [flags] ``` **Aliases:** `cloider database`, `cloider databases`, `cloider dbs`. Every subcommand that takes `` accepts the database's name (label), its original name or its id. ## Subcommands | Command | Description | | --- | --- | | [`cloider db list`](#cloider-db-list) | List databases | | [`cloider db get`](#cloider-db-get) | Show a database and how to reach it | | [`cloider db create`](#cloider-db-create) | Create a database | | [`cloider db delete`](#cloider-db-delete) | Delete a database and its data | | [`cloider db pause`](#cloider-db-pause) | Pause a database, keeping its data at a lower price until it is resumed | | [`cloider db resume`](#cloider-db-resume) | Resume a paused database | | [`cloider db status`](#cloider-db-status) | Print a database's status | | [`cloider db password`](#cloider-db-password) | Print a database user's password | | [`cloider db cert`](#cloider-db-cert) | Print the CA certificate that signs a database's TLS certificate | | [`cloider db connect`](#cloider-db-connect) | Connect with the engine's own client (psql, mysql, redis-cli, mongosh) | | [`cloider db shell`](#cloider-db-shell) | Open the engine's client inside the platform, already logged in | | [`cloider db exec`](#cloider-db-exec) | Run a query or script with the database's client, for scripts and AI agents | | [`cloider db backups`](#cloider-db-backups) | List a database's backups, newest first | | [`cloider db restore`](#cloider-db-restore) | Restore a backup into a new database, leaving this one as it is | | [`cloider db resize`](#cloider-db-resize) | Move a database to a larger plan (restarts it) | | [`cloider db rename`](#cloider-db-rename) | Change the name a database is shown and found by | | [`cloider db ssl`](#cloider-db-ssl) | Require TLS on a database, or stop requiring it (restarts it) | | [`cloider db trusted-sources`](#cloider-db-trusted-sources) | List or change who may connect to a database | | [`cloider db insights`](#cloider-db-insights) | Show a database's resource usage today (`-o json` for the month) | All subcommands also take the [global flags](/cli/configuration#global-flags). ## cloider db list List the account's databases with their engine, plan and status. ```text cloider db list [flags] ``` **Alias:** `cloider db ls`. ```bash cloider db list ``` ```text title="Output" NAME ENGINE PLAN STATUS CREATED orders-db PostgreSQL 18 Standard Ready 2026-09-02 14:12 shop-db MySQL 9 Starter Ready 2026-09-10 08:30 catalog-db MongoDB 8 Basic Paused 2026-09-18 17:02 cache Redis 8 Hobby Ready 2026-10-01 10:45 ``` `-o wide` adds the **ID** column, `-q` prints the ids, and `-o json` prints the API's list with fields such as `hashed_id`, `database_name`, `database_label`, `database_user`, `service`, `database_version`, `database_plan`, `trusted_sources`, `ssl`, `status` and `created_at`. ```bash # Every PostgreSQL database cloider db list -o json | jq -r '.[] | select(.service == "PostgreSQL") | .database_label' ``` MCP tool: `list_databases`. ## cloider db get Show a database and how to reach it: hosts, port, database name, user, SSL and trusted sources. The password is printed by [`cloider db password`](#cloider-db-password). ```text cloider db get [flags] ``` **Alias:** `cloider db show`. | Argument | Description | | --- | --- | | `` | Name or id of the database | ```bash cloider db get orders-db ``` ```text title="Output" Name: orders-db Engine: PostgreSQL 18 Plan: Standard Status: Ready Host: orders-db-p0q9zm.db.cloider.com Private host: orders-db-p0q9zm.db.cloider.internal Port: 20417 Database: orders-db User: orders_db_user SSL: yes Trusted sources: anywhere Created: 2026-09-02 14:12 Password: `cloider db password orders-db`, connect: `cloider db connect orders-db` ``` - **Host** is the public host, reachable from the internet if the trusted sources allow it. - **Private host** is reachable only from your own Cloider clusters and apps. - **Trusted sources** lists who may connect: `anywhere`, IPv4 addresses and ranges, `cluster:` and `app:`. `-o json` adds `host`, `private_host` and `database_port` to the list fields: ```bash cloider db get orders-db -o json | jq -r '"\(.host):\(.database_port)"' ``` ```text title="Output" orders-db-p0q9zm.db.cloider.com:20417 ``` See [Connect to a database](/databases/connect). MCP tool: `get_database`. ## cloider db create Create a database. ```text cloider db create [flags] ``` | Argument | Description | | --- | --- | | `` | Name of the new database. It becomes the database name inside the engine and part of the host name | | Flag | Type | Default | Description | | --- | --- | --- | --- | | `--engine` | string | (required) | `postgresql`, `mysql`, `redis` or `mongodb`. Also accepted: `postgres`, `pg`, `mongo` | | `--version` | string | the newest offered | Engine version | | `--plan` | string | `Hobby` | Plan: `Hobby`, `Starter`, `Basic`, `Standard`, `Plus` or `Pro` (any case). See [`cloider pricing`](/cli/commands/account#cloider-pricing) | | `--user` | string | `_user` | Database user. Dashes in the name become underscores: `orders-db` gets `orders_db_user` | | `--ssl` | bool | on, except for Redis | Require TLS | | `--no-ssl` | bool | `false` | Don't require TLS. Can't be combined with `--ssl` | | `--trusted-source` | string, repeatable | `*` (anywhere) | Who may connect: `*`, an IPv4 address or CIDR, `cluster:` or `app:` | | `--allow-my-ip` | bool | `false` | Also trust the public IPv4 address this command runs from | | `-w, --wait` | bool | `false` | Wait until the database is `Ready` | | `--timeout` | duration | `15m0s` | How long `--wait` waits | The CLI checks the engine, version and plan against what Cloider offers before creating anything, and names the valid choices when one is wrong: ```text Error: PostgreSQL 15 isn't offered, pick one of: 18 Error: unknown plan "large", pick one of: Hobby, Starter, Basic, Standard, Plus, Pro (see `cloider pricing`) ``` SSL is on by default for every engine except Redis, where turning it on makes the server accept TLS connections only. `--allow-my-ip` asks a public IP lookup service (`api.ipify.org`) for this machine's address, as the dashboard's **Allow My IP** button does. Create a PostgreSQL database with the defaults (Hobby plan, newest version, SSL, open to anywhere): ```bash cloider db create orders-db --engine postgresql ``` ```text title="Output" ✓ Creating PostgreSQL 18 database orders-db (plan Hobby) Follow it with `cloider db status orders-db`, or pass --wait next time. ``` A Redis cache only your app can reach, waiting until it is ready: ```bash cloider db create cache --engine redis --plan starter --trusted-source app:blog --wait ``` ```text title="Output" ✓ Creating Redis 8 database cache (plan Starter) ✓ Database cache is ready. Connect with `cloider db connect cache`. ``` A MySQL database open to an office network and your current IP: ```bash cloider db create shop-db --engine mysql --trusted-source 203.0.113.0/24 --allow-my-ip ``` A MongoDB database reachable from a cluster, with a custom user: ```bash cloider db create catalog-db --engine mongodb --plan basic --user catalog --trusted-source cluster:production ``` `-q` prints the new id and `-o json` prints `{"hashed_id": "..."}`. See [Create a database](/databases/create-a-database). MCP tool: `create_database`. ## cloider db delete Delete a database and its data. ```text cloider db delete [flags] ``` **Alias:** `cloider db rm`. | Flag | Type | Default | Description | | --- | --- | --- | --- | | `-w, --wait` | bool | `false` | Wait until the database is gone | | `--timeout` | duration | `15m0s` | How long `--wait` waits | The command asks you to type the database's name to confirm; pass `--yes` to skip it (required without a terminal). ```bash cloider db delete shop-db ``` ```text title="Output" This permanently deletes database shop-db. Type shop-db to confirm: shop-db ✓ Deleting database shop-db ``` ```bash cloider db delete shop-db --yes --wait ``` See [Pause, resume and delete](/databases/pause-resume-and-delete). MCP tool: `delete_database`. ## cloider db pause Pause a database. It stops serving connections and keeps its data at a lower price until you resume it. ```text cloider db pause [flags] ``` | Flag | Type | Default | Description | | --- | --- | --- | --- | | `-w, --wait` | bool | `false` | Wait until the database is `Paused` | | `--timeout` | duration | `15m0s` | How long `--wait` waits | ```bash cloider db pause catalog-db --wait ``` ```text title="Output" ✓ Pausing database catalog-db ✓ Database catalog-db is Paused ``` MCP tool: `pause_database`. ## cloider db resume Resume a paused database. ```text cloider db resume [flags] ``` | Flag | Type | Default | Description | | --- | --- | --- | --- | | `-w, --wait` | bool | `false` | Wait until the database is `Ready` | | `--timeout` | duration | `15m0s` | How long `--wait` waits | ```bash cloider db resume catalog-db --wait ``` ```text title="Output" ✓ Resuming database catalog-db ✓ Database catalog-db is Ready ``` MCP tool: `resume_database`. ## cloider db status Print a database's status and nothing else. ```text cloider db status [flags] ``` ```bash cloider db status orders-db ``` ```text title="Output" Ready ``` With `-o json` it prints `{"hashed_id": "...", "status": "Ready"}`. See [Status values](/reference/status-values). ## cloider db password Print the password of the database's user, to stdout and nothing else. ```text cloider db password [flags] ``` ```bash cloider db password orders-db ``` ```text title="Output" Xk9vQ2mL7pR4tW8zN3bY ``` ```bash # Build a connection string export DATABASE_URL="postgresql://orders_db_user:$(cloider db password orders-db)@orders-db-p0q9zm.db.cloider.com:20417/orders-db?sslmode=require" # User and password as JSON cloider db password orders-db -o json # {"user": "orders_db_user", "password": "..."} ``` MCP tool: `get_database_password`. ## cloider db cert Print the CA certificate that signs the database's TLS certificate, for clients that verify the server. A database with SSL off has none. ```text cloider db cert [flags] ``` | Flag | Type | Default | Description | | --- | --- | --- | --- | | `-f, --file` | string | stdout | Write to this file (mode `0600`) instead of stdout | ```bash cloider db cert cache -f ca.crt ``` ```text title="Output" ✓ Wrote the CA certificate of cache to ca.crt ``` ```bash cloider db cert orders-db > orders-ca.pem psql "host=orders-db-p0q9zm.db.cloider.com port=20417 user=orders_db_user dbname=orders-db sslmode=verify-ca sslrootcert=orders-ca.pem" ``` With SSL off, it fails with exit code `4`: ``database cache has SSL off, so it has no certificate (turn it on with `cloider db ssl ... on`)``. See [SSL/TLS](/databases/ssl-tls). MCP tool: `get_database_ca_cert`. ## cloider db connect Connect to the database with the engine's own client, already logged in: `psql`, `mysql`, `redis-cli` or `mongosh`. The client must be installed on your machine, and the database's [trusted sources](#cloider-db-trusted-sources) must allow where you connect from. [`cloider db shell`](#cloider-db-shell) needs nothing installed. ```text cloider db connect [flags] ``` | Flag | Type | Default | Description | | --- | --- | --- | --- | | `--print` | bool | `false` | Print the command instead of running it, without the password | | `--private` | bool | `false` | Use the private host, reachable from your clusters and apps | ```bash cloider db connect orders-db ``` ```text title="Output" psql (18.0) SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, compression: off) Type "help" for help. orders-db=> ``` The CLI fetches the password and hands it to the client through its environment variable (`PGPASSWORD`, `MYSQL_PWD`, `REDISCLI_AUTH`), so it doesn't show in your process list. `mongosh` has no such variable, so its password is passed as an argument. For Redis and MongoDB with SSL on, the CLI downloads the CA certificate into a temporary file for the client and removes it afterwards. When the client exits with an error, `cloider db connect` exits with the same code. See the command for each engine with `--print`: ```bash cloider db connect orders-db --print ``` ```text title="Output" psql -h orders-db-p0q9zm.db.cloider.com -U orders_db_user -d orders-db -p 20417 Password: `cloider db password orders-db` ``` | Engine | Command `--print` shows | | --- | --- | | PostgreSQL | `psql -h -U -d -p ` (with `PGSSLMODE=require` when SSL is on) | | MySQL | `mysql -h -P -u --ssl-mode=REQUIRED` (SSL on), or `--ssl-mode=DISABLED --get-server-public-key` (SSL off) | | Redis | `redis-cli -h -p --user --tls --cacert ca.crt` (`--tls --cacert` only with SSL on) | | MongoDB | `mongosh mongodb://@:/?directConnection=true&tls=true --tlsCAFile ca.crt` (TLS parts only with SSL on) | If the client isn't installed, the command says so: ``psql isn't installed, install it or use `cloider db shell ...`, which needs nothing installed``. If the database isn't `Ready`, it warns first. See [Connect to a database](/databases/connect). There is no MCP tool for `connect`, since it runs an interactive client. ## cloider db shell Open the engine's client (`psql`, `mysql`, `redis-cli` or `mongosh`) running next to the database, already logged in, in an interactive terminal session. Nothing has to be installed, and the trusted sources don't apply. It is the same terminal as the database's **Terminal** tab in the dashboard. The CLI shows `Starting the terminal…` while it gets ready, and keeps the session open while you use it. ```text cloider db shell [flags] ``` ```bash cloider db shell orders-db ``` ```text title="Output" Connected, exit the shell to end the session. orders-db=> SELECT count(*) FROM orders; count ------- 1284 (1 row) ``` A shell needs a terminal on both ends; in scripts use [`cloider db exec`](#cloider-db-exec). See [Terminal and exec](/databases/terminal-and-exec). ## cloider db exec Run a query or a script with the database's own client, already logged in and running next to the database, and exit with the client's exit code. Nothing has to be installed and the trusted sources don't apply, which makes it the way for scripts, CI jobs and AI agents to query a database. ```text cloider db exec [flags] [--] ``` | Argument | Description | | --- | --- | | `` | Name or id of the database | | `` | What to run. How the arguments are read depends on the engine, see below | | Flag | Type | Default | Description | | --- | --- | --- | --- | | `-i, --stdin` | bool | `false` | Run a script from stdin instead of a query, up to 2 MiB | | `--timeout` | duration | `10m0s` | Stop after this long, from `1s` up to `1h` | | Engine | The arguments are | Run with | | --- | --- | --- | | PostgreSQL | One SQL string | `psql -c` | | MySQL | One SQL string | `mysql -e` | | Redis | One command; one quoted argument is a command line | `redis-cli` | | MongoDB | JavaScript | `mongosh --eval` | Flags for `exec` go before the database. Give either a query or `-i`, not both. A PostgreSQL script run with `-i` stops at its first error. ```bash # PostgreSQL cloider db exec orders-db "SELECT count(*) FROM orders" cloider db exec orders-db "\dt" cloider db exec -i orders-db < migration.sql # MySQL cloider db exec shop-db "SHOW TABLES" # Redis cloider db exec cache SET greeting "hello world" cloider db exec cache GET greeting # MongoDB cloider db exec catalog-db "db.products.countDocuments()" ``` ```text title="Output of the first command" count ------- 1284 (1 row) ``` One JSON object for a script or agent: ```bash cloider db exec -o json orders-db "SELECT now()" ``` ```json title="Output" { "exit_code": 0, "stdout": " now\n-------------------------------\n 2026-10-20 09:41:07.112+00\n(1 row)\n\n", "stderr": "", "timed_out": false } ``` The exit code is the client's own, `124` when `--timeout` stopped it. See [exit codes of exec commands](/cli/output-and-scripting#exit-codes-of-exec-commands) and [Terminal and exec](/databases/terminal-and-exec). MCP tool: `database_exec`. ## cloider db backups List a database's backups, newest first, and the start of its point-in-time window. ```text cloider db backups [flags] ``` A database has a full backup every 14 days plus every change recorded since, so it has no listed backups. The command prints where its window starts instead: ```bash cloider db backups orders-db ``` ```text title="Output" Nothing to show. Restore the newest full backup plus every change since with `cloider db restore orders-db`, or any moment from 2026-10-13 01:31:07 UTC until now with `cloider db restore orders-db --time