Connecting
Connection strings, TLS, and the endpoints a managed cluster exposes.
Once a cluster is running, its Connect panel shows how to reach it. Relay composes the connection details server-side — you copy them rather than assembling a connection string by hand.
Connect methods
The panel provides ready-to-use details for:
- Relay CLI —
relay connect <name>(recommended; applies masking and policy). - Driver / URI — a
postgresql://URI for your application. - IDE / GUI — DBeaver, TablePlus, DataGrip.
- psql.
Endpoints
A cluster can expose two kinds of endpoint, selectable in the panel:
- Standard connection — a public hostname, gated by the workspace IP allowlist.
- Private endpoint — VPC / PrivateLink, with no allowlist needed. Add one under Private networking.
If a cluster has no public endpoint, connect through the Relay CLI or a private endpoint.
TLS & passwords
The URI Relay gives you carries no password by design — set PGPASSWORD or
use .pgpass. TLS verifies against your system trust store; there's no
certificate to download. The URI uses sslrootcert=system, which needs a
client built on libpq 16 or newer (older psql versions will not accept it).
Connection details only appear once the cluster is running, and revealing the URI
or command requires the org.connections.connect permission.