You need:

• A Claix account with dashboard access (/dashboard).
• A PostgreSQL database reachable over the internet with TLS (Neon, Supabase, RDS, Cloud SQL, a VPS with a public hostname, etc.).
• Admin rights on that database to create the claix_agent role and policies.
• The database DNS hostname (never a literal IP), the database name, and a strong password for the role.

In the dashboard, open Database connection (/dashboard/database-connection).

• Never use the admin user (postgres, supabase_admin, etc.) with Claix.
• Claix only accepts the username claix_agent.
• Do not grant that role SUPERUSER, CREATEDB, CREATEROLE, REPLICATION, or BYPASSRLS.
• Open only the tables you need, with SELECT (Retrieve) or SELECT + INSERT (Ingest). Do not grant UPDATE, DELETE, or TRUNCATE.
• The host must be a public DNS name. Localhost, raw IPs, and private networks are blocked.
• The password is tested on connect and stored in Vault—it does not stay in the browser or in public dashboard tables.

In your provider’s SQL editor (Neon, Supabase SQL Editor, psql, etc.), run the script below. Replace your-strong-password and, if your database is not named postgres, change the name in the grant connect line.

create role claix_agent login password 'your-strong-password';
grant connect on database postgres to claix_agent;
grant usage on schema public to claix_agent;

If you still have the older claix_ingest role, rename it:

alter role claix_ingest rename to claix_agent;

Without USAGE on the schema, Claix can connect but will not see tables. If you use schemas other than public, repeat the grant usage for each one.

Pick the access level for the product you will use. Replace public.your_table with each real table.

Read-only (Retrieve / agents) — the stricter option:

grant select on public.your_table to claix_agent;
create policy claix_agent_select on public.your_table
  for select to claix_agent using (true);

Ingest (read and insert) — when Claix Ingest should write rows:

grant select, insert on public.your_table to claix_agent;
grant usage, select on all sequences in schema public to claix_agent;
create policy claix_agent_ingest_select on public.your_table
  for select to claix_agent using (true);
create policy claix_agent_ingest_insert on public.your_table
  for insert to claix_agent with check (true);

If the table has RLS enabled and you skip the policy, claix_agent will see no rows even with the grant.

Open the firewall or provider allow-list so Claix can reach the port over TLS from the internet. If the host only allows specific IPs, add Claix’s when your provider or support shares them.

1. Go to /dashboard and sign in.
2. In the sidebar, open Database connection.
3. Confirm the engine is PostgreSQL (the option available today).
4. Fill in connection name, host, port, database, username claix_agent, password, and SSL mode.
5. If you use verify-full, paste the full CA certificate (including BEGIN CERTIFICATE / END CERTIFICATE lines).
6. Click Test and save. Claix validates the role, TLS, and permissions.
7. On success you will see an active connection. Use Reload schema to refresh tables and columns.

If it fails, read the dashboard message—it usually means unreachable host, wrong SSL, a username other than claix_agent, or missing USAGE / policies.

With the database linked you can:

• Retrieve: build the Data Map, routes, and agents in the Retrieve menu, then try them in the Sandbox.
• Ingest / Rules: map Claix schemas to PostgreSQL tables and define which fields are written.
• Check visible tables: if the list is empty, grant USAGE on the schema again and SELECT policies on the tables.

To disconnect, use the disconnect action on the same page (it asks for confirmation). Products that depend on that connection will stop until you connect again.

1. claix_agent role created with LOGIN and no dangerous privileges.
2. GRANT CONNECT on the database and USAGE on the schema.
3. Policy + grant on each table (SELECT or SELECT+INSERT).
4. Public DNS host, allowed port, SSL enabled.
5. Dashboard form with username exactly claix_agent.
6. “Test and save” succeeds and schema is reloaded.

Can I use Supabase or Neon? Yes. Use the connection hostname from the provider, the port (often 5432 or the pooler), and create claix_agent in the SQL Editor.

Why don’t I see tables? Almost always missing GRANT USAGE ON SCHEMA … or RLS policies for claix_agent.

Is the password stored in the browser? No. It is only sent when testing the connection and stored in Vault on the backend.

Can I connect several databases at once? The dashboard uses the workspace’s active connection. Disconnect or replace it before pointing at another instance.

Does Retrieve need INSERT? No. Query agents only need the SELECT-only policy. Reserve INSERT for Ingest flows.