# Connect to a Cloider database

> Find a Cloider database's host, port, user, password and CA certificate, and connect over the public or private endpoint with a connection string or client.

Every Cloider database has the same six connection details: a host, a port, a user, a password, a database name and, when SSL is on, a CA certificate. This page shows where to find each one, when to use the public or the private host, and the connection string and command line for every engine.

For code examples in your language, see the engine pages: [PostgreSQL](/databases/postgresql), [MySQL](/databases/mysql), [MongoDB](/databases/mongodb) and [Redis](/databases/redis).

## Connection details at a glance

| Detail | Example (`orders-db`, PostgreSQL) | Where it comes from |
| --- | --- | --- |
| **Public host** | `orders-db-p0q9zm.db.cloider.com` | `<name>-<id>.db.cloider.com` |
| **Private host** | `orders-db-p0q9zm.db.cloider.internal` | `<name>-<id>.db.cloider.internal` |
| **Port** | `20417` | Assigned when the database is created. The same for both hosts |
| **User** | `orders_db_user` | Chosen when the database is created |
| **Password** | 32 random characters | Generated by Cloider. Shown on request only |
| **Database name** | `orders-db` | The database's name. For Redis, the logical database number, `0` by default |
| **CA certificate** | `orders-db-ca.crt` | Only when SSL is on. See [SSL/TLS](/databases/ssl-tls) |

The `<id>` in the host is the database's id, a short string of lower case letters and digits that never changes. It is also in the dashboard's URL for the database and in `cloider db list -o wide`.

## Find the connection details

**Dashboard**

1. Open **Databases** in the sidebar.
2. Click the database's name. The name is a link once the database is **Ready**.
3. The **Overview** tab shows:
   - **Summary**: status, engine, plan, CPU, RAM and disk.
   - **Quick Connect**: a ready to paste **CLI** command and a **DSN** (connection string), on a **Public** and a **Private** tab.
   - **Connection Details**: **Username**, **Password**, **DB name**, **Private host**, **Public host**, **Port** and, with SSL on, **SSL** with a download button for the CA certificate.

Click any row or box to copy it. Copying the CLI command or the DSN copies it with the real password filled in, while the page itself shows the password masked.

**CLI**

```bash
cloider db get orders-db
```

```text title="Output"
Name:             orders-db
Engine:           PostgreSQL 18
Plan:             Standard
Status:           Ready
Host:             orders-db-p0q9zm.db.cloider.com
Private host:     orders-db-p0q9zm.db.cloider.internal
Port:             20417
Database:         orders-db
User:             orders_db_user
SSL:              yes
Trusted sources:  anywhere
Created:          2026-09-02 14:12

Password: `cloider db password orders-db`, connect: `cloider db connect orders-db`
```

Add `-o json` for the full API response, or `-o wide` to also show the id.

**Terraform**

The `cloider_database` resource exports every detail as an attribute:

```hcl title="outputs.tf"
output "host"         { value = cloider_database.orders.host }
output "private_host" { value = cloider_database.orders.private_host }
output "port"         { value = cloider_database.orders.port }
output "user"         { value = cloider_database.orders.user }
output "database"     { value = cloider_database.orders.name }

output "password" {
  value     = cloider_database.orders.password
  sensitive = true
}

output "ca_certificate" {
  value     = cloider_database.orders.ca_certificate
  sensitive = true
}
```

**API**

```bash
curl https://cloider.com/api/databases/p0q9zm \
  -H "Authorization: Bearer $CLOIDER_TOKEN"
```

```json title="Response"
{
  "hashed_id": "p0q9zm",
  "database_name": "orders-db",
  "database_label": "orders-db",
  "database_user": "orders_db_user",
  "service": "PostgreSQL",
  "database_version": "18",
  "status": "Ready",
  "database_plan": "Standard",
  "trusted_sources": [{"name": "Allow Everything", "code": "*", "type": "Anywhere"}],
  "created_at": "2026-09-02T14:12:08Z",
  "database_port": "20417",
  "ssl": true,
  "host": "orders-db-p0q9zm.db.cloider.com",
  "private_host": "orders-db-p0q9zm.db.cloider.internal"
}
```

The port is returned as a string.

**MCP**

```text title="Prompt"
How do I connect to orders-db?
```

```json title="Tool call: get_database"
{"database": "orders-db"}
```

The tool returns the host, private host, port, database name, user, SSL and trusted sources. The password comes from a separate tool, `get_database_password`.

## Get the database password

Cloider generates a random 32 character password for the database user when the database is created. It uses only letters, digits, `_`, `-` and `.`, so it can be used in a connection string as is. The password can't be changed from the dashboard, CLI, Terraform or API.

**Dashboard**

On the **Overview** tab, in **Connection Details**, click **show** next to **Password** to reveal it, or click the row to copy it.

**CLI**

```bash
cloider db password orders-db
```

```text title="Output"
Xq7rT2-vLp9_aZk4.Nw8sYb3HcD6mJe1
```

Use it in a script without printing it:

```bash
export PGPASSWORD="$(cloider db password orders-db)"
```

**Terraform**

Read `cloider_database.orders.password`. It is a sensitive attribute, so Terraform hides it in plan output, but it is stored in the state file.

```bash
terraform output -raw password
```

**API**

```bash
curl "https://cloider.com/api/database/password?id=p0q9zm" \
  -H "Authorization: Bearer $CLOIDER_TOKEN"
```

```text title="Response"
Xq7rT2-vLp9_aZk4.Nw8sYb3HcD6mJe1
```

The response is plain text, not JSON. Note the path: `/api/database/password` (singular), with the id in the `id` query parameter.

**MCP**

```text title="Prompt"
Get the password of orders-db.
```

```json title="Tool call: get_database_password"
{"database": "orders-db"}
```

:::warning[Who can read the password]
Reading the password is a read operation, so every member of the account and every API token can do it, including read-only ones. Treat access to the account as access to the database, and keep the [trusted sources](/databases/trusted-sources) narrow so that a leaked password alone isn't enough.
:::

## Get the CA certificate

When SSL is on, the database's TLS certificate is signed by Cloider's own certificate authority (CA). Clients that verify the server, which Redis and MongoDB clients do by default, need that CA certificate. Get it from the **SSL** row on the Overview tab (the download button saves `<name>-ca.crt`), with `cloider db cert orders-db -f ca.crt`, from the `ca_certificate` Terraform attribute, from `GET /api/database/cert?id=<id>` or with the `get_database_ca_cert` MCP tool. [SSL/TLS](/databases/ssl-tls) explains each engine's TLS options in detail.

## Public and private endpoints

Every database can be reached at two host names. They lead to the same database, on the same port, with the same user and password.

| | Public host | Private host |
| --- | --- | --- |
| Example | `orders-db-p0q9zm.db.cloider.com` | `orders-db-p0q9zm.db.cloider.internal` |
| Reachable from | The internet: your computer, CI, servers in other clouds | Your Cloider [apps](/apps/overview) and [Kubernetes clusters](/kubernetes/overview) |
| Trusted sources that apply | `*` and IPv4 addresses or ranges | `*`, and your apps and clusters |
| Use it for | Local development, admin tools, CI jobs, external services | Your application running on Cloider |

### Which host should my app use?

Use the private host for anything that runs on Cloider, and the public host for everything else. Traffic to the private host stays inside Cloider's network, and the app and cluster entries in [trusted sources](/databases/trusted-sources) only match connections that arrive on the private host. Your laptop, CI runners and servers elsewhere can't resolve or reach the private host, so they use the public host.

### Which port does my database use?

Each database gets its own port when it is created, and keeps it for life. The port is in the connection details, and it is never the engine's default port (5432 for PostgreSQL, 3306 for MySQL, 27017 for MongoDB, 6379 for Redis).

Always pass the port explicitly. A client that falls back to the engine's default port won't reach a Cloider database. If your network only allows outbound traffic to known ports, allow your database's port.

## Connection strings by engine

A connection string (also called a DSN or a database URL) puts every detail in one value, which most frameworks read from an environment variable such as `DATABASE_URL`. These are the exact formats the dashboard's **DSN** box uses. Replace `PASSWORD` with the password, and use the private host from your Cloider apps and clusters.

| Engine | SSL on | SSL off |
| --- | --- | --- |
| PostgreSQL | `postgresql://orders_db_user:PASSWORD@orders-db-p0q9zm.db.cloider.com:20417/orders-db?sslmode=require` | `postgresql://orders_db_user:PASSWORD@orders-db-p0q9zm.db.cloider.com:20417/orders-db` |
| MySQL | `mysql://shop_db_user:PASSWORD@shop-db-k7x2wd.db.cloider.com:22861/shop-db` | `mysql://shop_db_user:PASSWORD@shop-db-k7x2wd.db.cloider.com:22861/shop-db` |
| MongoDB | `mongodb://catalog_db_user:PASSWORD@catalog-db-m3v8rt.db.cloider.com:24309/catalog-db?directConnection=true&tls=true` | `mongodb://catalog_db_user:PASSWORD@catalog-db-m3v8rt.db.cloider.com:24309/catalog-db?directConnection=true` |
| Redis | `rediss://cache_user:PASSWORD@cache-c5n1qa.db.cloider.com:26742/0` | `redis://cache_user:PASSWORD@cache-c5n1qa.db.cloider.com:26742/0` |

Notes:

- **PostgreSQL**: `sslmode=require` encrypts the connection without checking the certificate. Use `sslmode=verify-full&sslrootcert=ca.crt` to also verify it, see [SSL/TLS](/databases/ssl-tls).
- **MySQL**: the URL has no SSL parameter, because `mysql://` parsers don't agree on one. MySQL clients negotiate TLS on their own when the server offers it. Set your driver's SSL option to require it, see [MySQL](/databases/mysql).
- **MongoDB**: the user is created in the database named in the path, so no `authSource` is needed. With `tls=true`, the client must trust the CA certificate (for example `tlsCAFile=ca.crt`).
- **Redis**: `rediss://` (two s) is TLS. With SSL on, Redis accepts only TLS connections, and the client must trust the CA certificate. `/0` selects logical database 0.

## Connect with a command line client

These are the commands the dashboard's **CLI** box shows. They read the password from an environment variable, so it doesn't end up in your shell history. The [`cloider db connect`](#connect-with-cloider-db-connect) command runs the same commands for you.

**PostgreSQL**

```bash
PGPASSWORD='PASSWORD' PGSSLMODE=require psql -h orders-db-p0q9zm.db.cloider.com -U orders_db_user -d orders-db -p 20417
```

**MySQL**

```bash
# SSL on
MYSQL_PWD='PASSWORD' mysql -h shop-db-k7x2wd.db.cloider.com -P 22861 -u shop_db_user shop-db --ssl-mode=REQUIRED

# SSL off
MYSQL_PWD='PASSWORD' mysql -h shop-db-k7x2wd.db.cloider.com -P 22861 -u shop_db_user shop-db --ssl-mode=DISABLED --get-server-public-key
```

**MongoDB**

```bash
# SSL on, with the CA certificate saved as ca.crt
mongosh "mongodb://catalog_db_user:PASSWORD@catalog-db-m3v8rt.db.cloider.com:24309/catalog-db?directConnection=true&tls=true" --tlsCAFile ca.crt

# SSL off
mongosh "mongodb://catalog_db_user:PASSWORD@catalog-db-m3v8rt.db.cloider.com:24309/catalog-db?directConnection=true"
```

**Redis**

```bash
# SSL on, with the CA certificate saved as ca.crt
REDISCLI_AUTH='PASSWORD' redis-cli -h cache-c5n1qa.db.cloider.com -p 26742 --user cache_user --tls --cacert ca.crt

# SSL off
REDISCLI_AUTH='PASSWORD' redis-cli -h cache-c5n1qa.db.cloider.com -p 26742 --user cache_user
```

## Connect with cloider db connect

`cloider db connect` fetches the password (and the CA certificate when the client needs it) and starts the engine's own client, already logged in. The client (`psql`, `mysql`, `mongosh` or `redis-cli`) has to be installed, and your IP has to be in the database's trusted sources.

```bash
cloider db connect orders-db
```

```text title="Output"
psql (18.0)
SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, compression: off, ALPN: postgresql)
Type "help" for help.

orders-db=>
```

| Flag | Meaning |
| --- | --- |
| `--print` | Print the command instead of running it, without the password |
| `--private` | Use the private host, for running it from inside a Cloider cluster |

```bash
cloider db connect cache --print
```

```text title="Output"
redis-cli -h cache-c5n1qa.db.cloider.com -p 26742 --user cache_user --tls --cacert ca.crt
Password: `cloider db password cache`
CA certificate: `cloider db cert cache -f ca.crt`
```

If the client isn't installed, or you don't want to open the firewall to your IP, use [`cloider db shell`](/databases/terminal-and-exec) instead. It runs the client next to the database, needs nothing installed and ignores trusted sources.

## Connect from your computer or CI

To connect from outside Cloider, use the public host and make sure the database trusts your public IP address:

```bash
# Trust the IP this machine connects from, then connect
cloider db trusted-sources orders-db --add-my-ip
cloider db connect orders-db
```

For CI runners, add the runner's fixed egress IP or range with `--add 198.51.100.7`. Runners whose IP changes on every job can run their queries with [`cloider db exec`](/databases/terminal-and-exec), which doesn't need a trusted source. See [trusted sources](/databases/trusted-sources).

## Connect from a Cloider app or Kubernetes cluster

Apps and Kubernetes clusters on Cloider reach a database over the private host.

1. Add the app or cluster to the database's trusted sources, unless the database already trusts everything (`*`):

   ```bash
   cloider db trusted-sources orders-db --add app:api
   cloider db trusted-sources orders-db --add cluster:production
   ```

2. Build the connection string with the **private** host. Copy it from the **Private** tab of **Quick Connect** on the Overview tab, or build it:

   ```text
   postgresql://orders_db_user:PASSWORD@orders-db-p0q9zm.db.cloider.internal:20417/orders-db?sslmode=require
   ```

3. Give it to your code as a secret environment variable.

**Cloider app**

Set it as a secret variable on the app, see [environment variables](/apps/environment-variables):

```bash
cloider app env set api --secret \
  DATABASE_URL='postgresql://orders_db_user:PASSWORD@orders-db-p0q9zm.db.cloider.internal:20417/orders-db?sslmode=require'
```

Or set it on the first deploy:

```bash
cloider deploy --name api --secret-env DATABASE_URL='postgresql://orders_db_user:PASSWORD@orders-db-p0q9zm.db.cloider.internal:20417/orders-db?sslmode=require'
```

**Kubernetes cluster**

Store it in a Kubernetes Secret, with the CA certificate for clients that verify the server:

```bash
cloider db cert orders-db -f ca.crt

kubectl create secret generic orders-db \
  --from-literal=DATABASE_URL='postgresql://orders_db_user:PASSWORD@orders-db-p0q9zm.db.cloider.internal:20417/orders-db?sslmode=require' \
  --from-file=ca.crt=ca.crt
```

Then load it into your Deployment:

```yaml title="deployment.yaml"
apiVersion: apps/v1
kind: Deployment
metadata:
  name: api
spec:
  replicas: 2
  selector:
    matchLabels:
      app: api
  template:
    metadata:
      labels:
        app: api
    spec:
      containers:
        - name: api
          image: registry.cloider.com/acme/api:1.0
          envFrom:
            - secretRef:
                name: orders-db
```

With Terraform, the [`cloider_database` reference](/terraform/resources/database) shows how to write the Secret from the database's attributes.

## How many connections can my database handle?

Each database accepts a limited number of simultaneous connections, which depends on the engine and the plan. The [Insights tab](/databases/insights) shows how many connections are open and the maximum the server allows. For MySQL, the maximum is set by the plan, from 20 on Hobby to 200 on Pro, see [MySQL](/databases/mysql).

To stay under the limit:

- Use one connection pool per process, and size it so that all your processes together stay under the maximum. A small plan with a few app instances needs a pool of only a few connections each.
- Close connections you don't need, especially in scripts and serverless functions.
- If you run out, [resize](/databases/resize) to a larger plan.

## Troubleshooting

| Symptom | Likely cause | Fix |
| --- | --- | --- |
| Connection times out | Your IP isn't in the trusted sources | `cloider db trusted-sources orders-db --add-my-ip` |
| Connection refused, or "could not translate host name" | Wrong host or port, or the database is paused | Copy the host and port from `cloider db get`, check the status is `Ready` |
| Private host doesn't resolve | You are connecting from outside Cloider | Use the public host |
| App can't connect on the private host | The app isn't in the trusted sources | `cloider db trusted-sources orders-db --add app:<name>` |
| Password authentication failed | Wrong password or user | Copy them again from the Overview tab |
| Certificate verify failed | The client doesn't trust Cloider's CA | Download the CA certificate and pass it to the client |

[Database troubleshooting](/databases/troubleshooting) has the full list, with the exact error messages of each client.

## Next steps

- [Restrict who may connect](/databases/trusted-sources)
- [Turn on and verify TLS](/databases/ssl-tls)
- [Connect from code: PostgreSQL](/databases/postgresql), [MySQL](/databases/mysql), [MongoDB](/databases/mongodb), [Redis](/databases/redis)
- [Run queries from the browser or the CLI](/databases/terminal-and-exec)