You need:

• A Claix account with dashboard access (/dashboard).
• A MySQL 8.0 or later server reachable over the internet with TLS (RDS, PlanetScale, DigitalOcean, TiDB, a VPS with a public hostname, and so on). If the server is MariaDB, use the MariaDB guide: Claix rejects a server that does not match the engine you picked.
• Admin rights to create the claix_agent user and the GRANTs.
• The DNS hostname (never a literal IP), the database name, and a strong password for the user.

In the dashboard, open Database connection (/dashboard/database-connection).

• Never use root or the admin user with Claix.
• Claix only accepts the username claix_agent.
• Create the user with REQUIRE SSL. Without TLS, Claix will not connect.
• SELECT only, table by table. Do not grant INSERT, UPDATE, DELETE, CREATE, DROP, ALTER, GRANT OPTION, roles, or global privileges (ON *.*).
• Grant nothing on mysql, sys, performance_schema, or information_schema.
• The host must be a public DNS name. Localhost, raw IPs, and private networks are blocked.
• The password is tested on connect and stored in Vault. It does not stay in the browser or in public dashboard tables.

In your provider’s SQL editor (RDS, MySQL Workbench, the mysql CLI, and so on), run the script. Replace your-strong-password.

CREATE USER 'claix_agent'@'%' IDENTIFIED BY 'your-strong-password' REQUIRE SSL;

The % host lets the user sign in from the internet. If your provider requires another host, use that value, but the username must be exactly claix_agent. This user has no global privileges: the GRANTs are per table.

Claix names tables as database.table. Replace your_db and your_table with the real names. The database name may contain only letters, numbers, and _.

GRANT SELECT ON `your_db`.`your_table` TO 'claix_agent'@'%';

Repeat the line for every table Retrieve should query. After you connect, tick the tables in the dashboard and Claix generates this SQL for you: copy it and run it on your database.

MySQL has no RLS policies. The GRANT is the limit: without it, Claix connects but cannot see that table.

Open the firewall or security group so the port accepts TLS from the internet. A self-signed certificate does not pass with require: use verify-full and paste the CA.

1. Go to /dashboard and sign in.
2. In the sidebar, open Database connection.
3. Choose the MySQL engine (Retrieve only).
4. Copy the SQL that creates claix_agent, change the password, and run it on your MySQL.
5. Fill in the connection name, host, port, database, and the claix_agent password. The username cannot be changed.
6. Pick SSL. With verify-full, paste the full CA certificate (including the BEGIN CERTIFICATE / END CERTIFICATE lines).
7. Click Test and save. Claix checks that the server is MySQL, reads SHOW GRANTS, and stores the password in Vault.
8. With the connection active, tick the tables and run the GRANT SELECT the dashboard generates. Then click Reload schema.

If it fails, the dashboard message points to an unreachable host, SSL, a username other than claix_agent, a version older than 8.0, a MariaDB server, or an extra privilege (writes, global, or GRANT OPTION).

With the database linked you can:

• Retrieve: build the Data Map, routes, and agents in the Retrieve menu, then try them in the Sandbox. Every query runs in a read-only transaction with a time limit.
• Check visible tables: if the list is empty, run the GRANT SELECT and reload the schema.

Ingest does not use this connection. To write rows, connect a PostgreSQL database. To disconnect, use the action on the same page (it asks you to type disconnect). Agents that depend on this connection stop until you connect again.

1. MySQL 8.0 or later, with TLS, and a claix_agent user created with REQUIRE SSL.
2. No global, write, system, or GRANT OPTION privileges.
3. GRANT SELECT on every table Retrieve should read.
4. Public DNS host, allowed port, SSL enabled.
5. Dashboard form set to MySQL, with the claix_agent password.
6. “Test and save” succeeds and the schema is reloaded.

Can I use Amazon RDS? Yes. Use the endpoint (the hostname, not the IP), port 3306, the database you created, and SSL require. The security group must accept the port from the internet.

Why don’t I see tables? The GRANT SELECT on those tables is missing, or you have not clicked Reload schema after granting it.

Is the password stored in the browser? No. It is only sent when testing the connection and stored in Vault on the backend.

Can I connect several databases at once? The dashboard shows the workspace’s active connection. Disconnect before pointing at another instance. Ingest only loads the PostgreSQL connection.

The dashboard says the server is MariaDB. Pick the MariaDB engine and try again. Claix does not treat MariaDB as MySQL.

Does Retrieve need INSERT? No. Only SELECT. Ingest, which does write, is PostgreSQL.