Connecting
Create connection profiles for every engine, with SSH tunnels for remote servers.
Create a connection
- Open Database Client and click New Connection.
- Pick the engine: PostgreSQL, CockroachDB, MySQL, MariaDB, SQLite, Redis, MongoDB, or DynamoDB.
- Fill in the fields for that engine (below).
- Test, then Save. The password goes to the macOS Keychain — profiles on disk never contain secrets.
Per-engine notes
PostgreSQL / CockroachDB
Host, port (5432 / 26257), database, username, password. CockroachDB speaks the Postgres protocol — pick the CockroachDB engine and the app handles the rest.
MySQL / MariaDB
Host, port (3306), database, username, password.
SQLite
Just pick the .sqlite / .db file. The app remembers it with a security-scoped bookmark (that's macOS-speak for "you granted access to this file once, and it sticks").
WAL-mode databases
Some SQLite databases keep sidecar files (-wal, -shm) next to the main file. If yours does, grant access to the folder rather than the single file.
Redis
Host, port (6379), optional password. Redis opens a key-value workspace instead of a SQL view — see Redis, MongoDB & DynamoDB. TLS isn't supported yet; for a TLS-only server, tunnel over SSH instead.
MongoDB
Host, port (27017), database, optional username/password.
DynamoDB
The profile fields map to AWS credentials:
| Profile field | DynamoDB meaning |
|---|---|
| Username | Access key ID |
| Password | Secret access key (stored in Keychain) |
| Host (optional) | Custom endpoint — e.g. http://localhost:8000 for DynamoDB Local |
| Region | AWS region |
SSH tunnels
For servers that only listen inside a private network:
- Open SSH Profiles and add one: host, port (
22), username, password. - In the connection profile, attach that SSH profile.
- On connect, the app opens the tunnel first, then connects the database through it — automatically, every time.
One SSH profile can serve many database connections. Key-file authentication is on the roadmap; password auth works today.
Production flag
Mark a profile as production and the safe-mode level Touch ID for production will demand a fingerprint for every write on it. Mark anything you'd be sad to break.