Connections

A connection is a named, agent-routed proxy to an upstream database. It records where the database is and how to reach it — the credentials themselves are either encrypted in Relay or resolved by the agent at connect time.

Fields

Name, Engine and Host are required to save a connection (the dashboard fills in the engine's default port, and the agent defaults to default). The full form covers:

• Engine — the database type (postgres, mongodb, or mysql); sets a default port.
• Connection — Name (immutable after creation), Host, Port, and Database.
• Credentials — the user and how its password is resolved (below).
• Agent — the connection's main agent (default: default). To serve the connection from several agents, use relay connections agents set.
• Security — masking and query audit. Query audit is on by default (in the dashboard and the CLI); turn it off per connection if you do not want it.
• Policies — query-firewall policies to activate.

Credentials

You choose how the database password is supplied:

• Store in Relay — the password is encrypted at rest and never shown again, not even to you. The server seals it with AES-256-GCM under a per-organization data key, and that data key is itself wrapped by a key-encryption key (held by the server, or in AWS KMS or Vault Transit on deployments configured that way), so a copy of the database does not contain usable passwords. The server decrypts it only to hand it to the agent for the connection.
• Agent resolves it — Relay never sees the password. You pick a credential source and a reference (e.g. secret/data/prod#password); Relay stores only the reference, never the secret.

Sessions

Each connection tracks its live tunnel sessions — identity, start time, last-seen, and bytes in/out — so you can see who is connected in real time.