> ## Documentation Index
> Fetch the complete documentation index at: https://basedash.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# Connection settings
> SSL, SSH tunnels, the IP allowlist, schema sync, and other settings for databases and warehouses you connect directly
Connection settings control how Basedash reaches a database or warehouse you connect directly: its credentials, encryption, network path, and how Basedash reads its schema.
> [!NOTE]
>
> Only admins can add data sources.
## Overview
When you add a database or warehouse, Basedash asks for its credentials and verifies the connection before saving it. Once connected, Basedash reads the schema so the AI knows which tables and columns exist, and runs queries directly against the source each time a chart or answer needs data.
For setup steps for a specific database, see its page under **Databases** or **Warehouses**. For SaaS tools, see [SaaS connectors](https://basedash.com/docs/data-sources/connectors/index.md).
## Credentials
Most SQL databases use the same fields:
| Field | Notes |
| - | - |
| Host | The hostname or IP address of the database server |
| Port | The database port, such as 5432 for PostgreSQL or 3306 for MySQL |
| Database name | The database to connect to. Oracle calls this **Service name**. |
| Username | Use a dedicated, read-only user for Basedash |
| Password | Stored encrypted with AES-256 |
For PostgreSQL, Supabase, MySQL, and PlanetScale, you can leave the database name empty and pick a database after Basedash connects.
Some sources, such as BigQuery, Snowflake, Athena, and MotherDuck, use service accounts, keys, or tokens instead. See each source's page.
You can also paste a connection string, such as `postgresql://user:password@host:5432/database`, into the command menu (Cmd/Ctrl K) to start adding a data source with the fields filled in.
## SSL
Turn on **SSL** to encrypt the connection between Basedash and your database. Most cloud databases require it.
For PostgreSQL, Supabase, MySQL, PlanetScale, and Redshift, **Verify server certificate** appears when SSL is on. With it on, Basedash checks that the server's certificate is signed by a trusted certificate authority before connecting. Basedash trusts the standard public certificate authorities plus the AWS RDS and Supabase CAs, so most cloud databases work without extra setup.
* **CA certificate**: if your provider uses its own certificate authority, paste its CA certificate in PEM format into this optional field. It appears when **Verify server certificate** is on.
* New connections verify the certificate by default. Connections created before this setting existed stay encrypted without verifying until you turn it on.
* On MySQL and PlanetScale, enter the database's hostname rather than an IP address when verification is on.
Basedash doesn't support client certificates.
## Allowlist the Basedash IP
If your database or firewall only accepts known IP addresses, allow connections from:
```
24.199.77.73
```
All queries from Basedash cloud come from this address.
Basedash cloud only connects to public hosts. It refuses `localhost`, private network addresses such as `10.x.x.x` or `192.168.x.x`, and other internal addresses. To reach a database on a private network, use an [SSH tunnel](#ssh-tunnel) whose SSH host is public.
## SSH tunnel
Use an SSH tunnel when your database is in a private network that isn't reachable from the internet. Basedash connects to a bastion host you control, then to the database from there.
1. Turn on **Connect using SSH**.
2. Enter the **SSH host**, **SSH port** (usually 22), and **SSH username**.
3. Choose an **Authentication method**:
* **Private key**: paste the private key, and its passphrase if it has one.
* **Password**: enter the SSH user's password.
4. Allow `24.199.77.73` to reach the SSH host.
When you edit a connection, saved secrets aren't shown. Enter a new value to replace one, or click **Unset** to remove it.
## Manage a data source
Open the command menu with Cmd/Ctrl K and select a data source to:
* **Rename** it.
* **Edit AI context** to describe the data source for the AI. See [AI context](https://basedash.com/docs/features/ai-context.md#data-source-context).
* **Sync schema** to read new or changed tables and columns.
* **Update credentials**, for example after rotating a password.
* Set up **Row level security**. See [Row-level security](https://basedash.com/docs/administration/row-level-security.md).
* Manage **Access**. See [Data source access control](https://basedash.com/docs/administration/data-source-access-control.md).
* See **Associated charts** that query this data source.
* **Delete data source**.
## Schema sync
Basedash reads your schema when you add a data source and when you click **Sync schema**. After a sync, Basedash also profiles your tables, collecting approximate row counts, how recent the newest rows are, and sample values for each column, so the AI can write better queries. Profiling is limited in time and skips tables that were profiled recently, so it doesn't put heavy load on your database.
If you add tables or columns and the AI doesn't know about them yet, run **Sync schema**.
### Ignore schemas and tables
Self-hosted deployments can turn on schema ignore patterns to leave schemas or tables out of syncs, for example temporary or staging tables. See [Self-hosting](https://basedash.com/docs/self-hosting/overview.md).
## Query timeouts
Queries to PostgreSQL time out after about two minutes. If a chart times out, narrow its date range, add filters, or create a [model](https://basedash.com/docs/features/models.md) that pre-aggregates the data.
## Troubleshooting
When Basedash can't connect, it shows one of these errors:
| Error | What to check |
| - | - |
| Host not found | The hostname is spelled correctly and resolves publicly. Private hostnames need an [SSH tunnel](#ssh-tunnel). |
| Connection timed out | Your firewall or security group allows `24.199.77.73`, and the database accepts external connections. |
| Incorrect port | The port matches your database. Nothing is listening on the port you entered. |
| Incorrect username or password | The credentials are current. Check for copied whitespace. |
| User not found | The user exists on this database server. |
| Database does not exist | The database name is spelled correctly and the user can access it. |
| Unable to connect to database | SSL settings match what your database requires, and the database is running. |
Basedash may also show these messages:
| Message | What to do |
| - | - |
| Couldn't verify the server's SSL certificate | Paste your provider's CA certificate into **CA certificate**, or turn off **Verify server certificate**. See [SSL](#ssl). |
| This host isn't reachable from Basedash | The host is private or internal. Use the database's public hostname, or connect through an [SSH tunnel](#ssh-tunnel). |
| This SSH host isn't reachable from Basedash | Use the bastion's public hostname as the **SSH host**. |
| Too many connection tests | Basedash tests up to 20 connections per minute for each organization. Wait a minute and try again. |
If the connection works but tables are missing, make sure the database user has `SELECT` permission on those schemas, then run **Sync schema**.
## FAQ
> [accordion] Does Basedash need write access?
>
> No. Basedash works with read-only users, and we recommend one. If the user
> can write, the AI can propose changes on some databases, but only with your
> approval. See [Accuracy and
> trust](https://basedash.com/docs/features/accuracy-and-trust.md#read-only-by-default).
> [accordion] How often does Basedash query my database?
>
> Basedash queries your database when charts load, when the AI answers a
> question, and when automations, insights, or subscriptions run. With [query
> caching](https://basedash.com/docs/administration/organization-settings.md#query-caching) on, charts
> show cached results first and refresh in the background.
> [accordion] Can I connect a database on localhost?
>
> Not from Basedash cloud, which refuses localhost and private network
> addresses. The database must be reachable from the internet, directly or
> through an SSH tunnel with a public SSH host. For fully private networks,
> consider [self-hosting](https://basedash.com/docs/self-hosting/overview.md).
## Related
> [card] [Choose how to connect](https://basedash.com/docs/data-sources/introduction.md)
>
> Compare direct connections, connectors, and Basedash Warehouse.
> [card] [Data source access control](https://basedash.com/docs/administration/data-source-access-control.md)
>
> Choose who can query each data source.
> [card] [Security and compliance](https://basedash.com/docs/administration/security.md)
>
> How Basedash protects your credentials and data.
> [card] [Troubleshooting](https://basedash.com/docs/help/troubleshooting.md)
>
> Fix common problems.
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.