Connect a PostgreSQL client
Use a PostgreSQL-compatible client to read your database. Copy the real listener settings from Connect and use your separate database login. The currently offered login is read-only; it does not authorize SQL writes or ORM schema migrations.
- Open Database loginCopy its host, port, database and separate login credentials.
- Configure TLSUse the certificate and SSL settings supplied for this connection.
- Test the connectionRun SELECT 1 with the intended database identity.
- Read a known tableCheck a small result before connecting your application.
Check listener availability
Open Connect → PostgreSQL for the instance. Confirm that the listener is enabled and that you have an active database login. An HTTPS endpoint or a protocol listed in engine capabilities is not proof that a usable SQL listener exists.
Copy the actual connection details
Copy Host, Port, Database, SSL and Username from the supplied settings. Do not assume port 5432 or derive the SQL host from the HTTPS address.
Use Database login to create or reset your own password where available. A password is shown only after creation or reset; an existing password cannot be revealed. OC_TOKEN is an HTTPS credential, not a PostgreSQL password.
Follow the instance’s network requirements and use the permitted client address.
Connect with psql
Replace every placeholder in this reference command with the supplied listener settings. Use the appropriate CA file and hostname verification for your driver. The first query should return one row with connected = 1.
TLS is required. sslmode=require encrypts the connection but does not by itself verify the certificate. Check your libpq version, server-name handling and CA configuration; do not disable verification to suppress an error.
# Set these from Connect → PostgreSQL for your instance.
export PGHOST="YOUR_SQL_HOST"
export PGPORT="YOUR_SQL_PORT"
export PGDATABASE="YOUR_DATABASE"
export PGUSER="YOUR_SQL_USER"
# Supply PGPASSWORD through your secret manager or let psql prompt for it.
# Use the TLS mode and CA supplied for the listener.
export PGSSLMODE="verify-full"
export PGSSLROOTCERT="/path/to/provided-ca.pem"
psql --command "SELECT 1 AS connected;"DBeaver
- Create a PostgreSQL connection with the standard PostgreSQL driver.
- Enter the supplied host, port, database and username.
- Configure the supplied TLS trust settings and enter the database-login password.
- Test the connection, then run
SELECT 1 AS connected. - Read a small known table.
A successful read does not establish support for every object-browser feature or schema editor. This is setup guidance, not a certification of every DBeaver version.
pgAdmin
Register a server with the supplied connection and TLS settings. Use Query Tool to run a small read. Some monitoring views issue PostgreSQL catalog queries outside the supported subset, so test the pages you need. The connection remains read-only.
ODBC and reporting tools
Use a compatible PostgreSQL ODBC driver and the same listener and TLS settings. Test the report’s metadata queries as well as its data query. Do not infer complete reporting-tool compatibility from a successful login.
Check the operations your application sends
Test the exact read statements and metadata queries your driver sends. PostgreSQL protocol support does not mean full PostgreSQL compatibility. The current database-login contract is read-only; write support in newer source is not a deployed feature.
For application writes, use the supported HTTPS API and check the configured credential’s permissions. See PostgreSQL compatibility.
Transactions and access controls
A database login is tied to one database and its linked database identity. Its permissions cannot exceed the member’s current access. Test as that identity, not with an administrative credential.
Do not use write transactions, schema migrations or ORM automatic schema creation through the current read-only login. Use HTTP transactions only on a deployment that supports them.
Troubleshoot a failed connection
- Timeout: check listener status, DNS, the network route and any address restrictions.
- TLS failure: check the hostname, CA, driver version and certificate verification.
- Login failure: check the separate database username/password and reset status.
- Statement failure: keep the SQLSTATE and message, then check support and permissions.
Remove passwords from logs and screenshots before sharing them. For application access without a SQL driver, use the HTTP API.