--- title: How to Connect to PostgreSQL Database Clusters description: Connect to PostgreSQL database clusters from the command line or other applications. product: Databases url: https://docs.digitalocean.com/products/databases/postgresql/how-to/connect/ last_updated: "2026-08-03" --- > **For AI agents:** The documentation index is at [https://docs.digitalocean.com/llms.txt](https://docs.digitalocean.com/llms.txt). Markdown versions of pages use the same URL with `index.html.md` in place of the HTML page (for example, append `index.html.md` to the directory path instead of opening the HTML document). # How to Connect to PostgreSQL Database Clusters PostgreSQL is an open source, object-relational database built for extensibility, data integrity, and speed. Its concurrency support makes it fully ACID-compliant, and it supports dynamic loading and catalog-driven operations to let users customize its data types, functions, and more. Connect to DigitalOcean managed PostgreSQL database clusters from `psql`, GUI clients such as DataGrip, or other applications. Retrieve each cluster’s hostname, port, credentials, and TLS settings using the Control Panel, API, or CLI, then configure your client. ## Retrieve Database Connection Details Using Automation You can retrieve connection details using the DigitalOcean CLI (`doctl`) or the API. ### Retrieve Database Connection Details via CLI ## How to Retrieve Database Connection Details Using the DigitalOcean CLI 1. [Install `doctl`](https://docs.digitalocean.com/reference/doctl/how-to/install/index.html.md), the official DigitalOcean CLI. 2. [Create a personal access token](https://docs.digitalocean.com/reference/api/create-personal-access-token/index.html.md) and save it for use with `doctl`. 3. Use the token to grant `doctl` access to your DigitalOcean account. ```shell doctl auth init ``` 4. Finally, run `doctl databases connection`. Basic usage looks like this, but you can [read the usage docs](https://docs.digitalocean.com/reference/doctl/reference/databases/connection/index.html.md) for more details: ```shell doctl databases connection [flags] ``` The following example retrieves the connection details for a database cluster with the ID `f81d4fae-7dec-11d0-a765-00a0c91e6bf6`: ```shell doctl databases connection f81d4fae-7dec-11d0-a765-00a0c91e6bf6 ``` ### Retrieve Database Connection Details via API This API call retrieves the information about your database, including its connection details. The connection details are located in the returned `connection` JSON object. ## How to Retrieve Database Connection Details Using the DigitalOcean API [Create a personal access token](https://docs.digitalocean.com/reference/api/create-personal-access-token/index.html.md) and save it for use with the API. ### cURL Send a GET request to [`https://api.digitalocean.com/v2/databases/{database_cluster_uuid}`](https://docs.digitalocean.com/reference/api/reference/databases/index.html.md#databases_get_cluster). Using cURL: ```shell curl -X GET \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $DIGITALOCEAN_TOKEN" \ "https://api.digitalocean.com/v2/databases/9cc10173-e9ea-4176-9dbc-a4cee4c4ff30" ``` ### Go Using [Godo](https://github.com/digitalocean/godo), the official DigitalOcean API client for Go: ```go import ( "context" "os" "github.com/digitalocean/godo" ) func main() { token := os.Getenv("DIGITALOCEAN_TOKEN") client := godo.NewFromToken(token) ctx := context.TODO() cluster, _, err := client.Databases.Get(ctx, "9cc10173-e9ea-4176-9dbc-a4cee4c4ff30") } ``` ### Python Using [PyDo](https://github.com/digitalocean/pydo), the official DigitalOcean API client for Python: ```python import os from pydo import Client client = Client(token=os.environ.get("DIGITALOCEAN_TOKEN")) get_resp = client.databases.get_cluster(database_cluster_uuid="a7a89a") ``` ## Retrieve PostgreSQL Cluster Connection Details Using the Control Panel To retrieve connection details, go to the [Databases page](https://cloud.digitalocean.com/databases) and select the cluster you want to connect to. On the cluster’s **Overview** page, scroll to the **Connection Details** section. ![The Connection Details section on a PostgreSQL cluster's Overview page.](https://docs.digitalocean.com/screenshots/databases/postgresql-connection-details.15642f4dc7dd4adec7482d9cacde4ff5692abe2ff4fbdcd9d9b9fab896df592d.png) In the **Connection Details** section, choose the network, database, user, and TLS settings to generate the connection details you need: - **Public network** and [**VPC network**](https://docs.digitalocean.com/products/networking/vpc/index.html.md) provide connection details for your cluster’s public and private hostnames. Only resources in the same VPC network as the cluster can connect using the private hostname. - The **Database/Pool** field updates the connection details for the selected database or connection pool. - The **User** field updates the connection details with the selected [user credentials](https://docs.digitalocean.com/products/databases/postgresql/how-to/manage-users-and-databases/index.html.md). - **TLS verification:** On PostgreSQL Standard Edition clusters and Advanced Edition clusters (in public preview), enable **`verify-full`** for full TLS certificate verification. Without this option, connection details set the client `sslmode` parameter to `require`, which encrypts traffic in transit but does not verify the server identity. ### Standard Edition When **`verify-full`** is enabled on Standard Edition clusters, connection details set `sslmode=verify-full` and include `sslrootcert` with the path to your [downloaded CA certificate](https://docs.digitalocean.com/products/databases/postgresql/how-to/connect/index.html.md#download-the-ssl-certificate). Replace the placeholder path with the path where you saved the certificate. ![The Connection Details section on a Standard Edition cluster with the verify-full toggle enabled, showing sslmode=verify-full, sslrootcert set to the CA certificate path, and a Download the CA Certificate banner.](https://docs.digitalocean.com/screenshots/databases/postgresql-verify-full.bfaa2688325e51a28a4dbe8300b97fe479bc05a10dd15d14e0ee65c06f3054bc.png) ### Advanced Edition When **`verify-full`** is enabled on Advanced Edition clusters, connection details set `sslmode=verify-full`. Advanced Edition clusters use your system’s trust store, so you do not download a CA certificate. ![The Connection Details section on an Advanced Edition cluster with the verify-full toggle enabled and an alert noting that libpq-based clients also require sslrootcert=system.](https://docs.digitalocean.com/screenshots/databases/postgresql-verify-full-advanced.53021b5fd4489cd280cd6cb44ca36ef7ac0abc2eda7f305457db40113717bbea.png) When **`verify-full`** is enabled, the copied connection string and connection parameters include `sslmode=verify-full` but do not include `sslrootcert=system`. For `libpq`-based clients such as `psql`, append `&sslrootcert=system` to the connection URI, or use the Advanced Edition connection string example in [Connect with verify-full](https://docs.digitalocean.com/products/databases/postgresql/how-to/connect/index.html.md#connect-to-the-database). Use a PostgreSQL client with `libpq` 16 or later. Older `libpq` versions treat `system` as a filename and the connection fails. Use the format menu in the **Connection Details** section to display the same connection information in one of three formats: - **Connection parameters:** Separate fields for `username`, `password`, `host`, `port`, `database`, and `sslmode`. Use this format when your client or application expects individual connection settings, such as DataGrip or pgAdmin. - **Connection string:** A single PostgreSQL URI (`postgresql://user:password@host:port/database`). Use this format when your client accepts a connection string on the command line or in an environment variable or application config file. - **Flags:** A complete `psql` command with connection values as environment variables and flags (`-U`, `-h`, `-p`, `-d`). Use this format to connect from a terminal with `psql`. By default, the Control Panel doesn’t reveal the cluster’s password for security reasons. Click **Copy** to copy connection details with the password, or click **show** to reveal the password. ## Download the CA Certificate This section applies to PostgreSQL Standard Edition clusters. Advanced Edition clusters do not provide a downloadable CA certificate; for Advanced Edition `verify-full` setup, see [Connect with verify-full](https://docs.digitalocean.com/products/databases/postgresql/how-to/connect/index.html.md#connect-to-the-database). PostgreSQL Standard Edition clusters include a CA certificate you can download to verify the server identity when connecting with `verify-full`. Save the certificate on your local system and reference its path in connection settings that use `sslrootcert` or `PGSSLROOTCERT`. To download the CA certificate for a Standard Edition cluster, go to the [Databases page](https://cloud.digitalocean.com/databases) and select the cluster whose CA certificate you want to download. On the cluster’s **Overview** page, in the **Connection Details** section, click **Download CA certificate**. ![Databases connection details with Download CA Certificate selected](https://docs.digitalocean.com/screenshots/databases/dbaas-ca-cert.9fb960438552d09dd402d9978059be30135522c0128d020afe9745874ae51d10.png) Each client application is configured differently, so check the documentation for the tool you use for more detail on setting up TLS connections. ## Connect to the Cluster This section describes how to connect to your cluster with `psql` or DataGrip and open a session in a database such as `defaultdb`. ### Connect Using psql To connect to a PostgreSQL database cluster using `psql`, do the following: - Add your local computer [to the cluster’s trusted sources](https://docs.digitalocean.com/products/databases/postgresql/how-to/secure/index.html.md#firewalls). - Install the [psql client](https://www.postgresql.org/docs/current/app-psql.html) on your local computer. You can also get `psql` by [installing PostgreSQL](https://www.postgresql.org/download/). - Reference the [database cluster’s connection details](https://docs.digitalocean.com/products/databases/postgresql/how-to/connect/index.html.md#connection-details), which tell your client how to connect to the cluster. Copy connection details from the Control Panel and run `psql` using the **Flags** or **Connection string** format. Replace placeholder values with your credentials and port. On Standard Edition clusters using `verify-full`, also replace the path to your [downloaded CA certificate](https://docs.digitalocean.com/products/databases/postgresql/how-to/connect/index.html.md#download-the-ssl-certificate). ## Connect with sslmode=require (default) By default, connection details return `ssl: true` and set the client `sslmode` parameter to `require`, which encrypts traffic in transit but does not verify the server identity. You do not need a CA certificate file for this mode. **Flags format:** The Control Panel default flags command uses `--set=sslmode=require`, but that option does not configure TLS in `psql`. Set `PGSSLMODE=require` instead. Replace ``, ``, and ``: ```shell PGPASSWORD= \ PGSSLMODE=require \ psql -U doadmin -h -p -d defaultdb ``` **Connection string:** Pass the connection string from the Control Panel in quotes to `psql`, replacing ``, ``, ``, and ``: ```shell psql "postgresql://:@:/defaultdb?sslmode=require" ``` ## Connect with verify-full Enable the **`verify-full`** toggle in the Control Panel to show connection details for full TLS certificate verification. ### Connect with verify-full on Standard Edition **Flags format:** Paste the entire command from the Control Panel into your terminal. Replace ``, ``, ``, and ``: ```shell PGPASSWORD= \ PGSSLMODE=verify-full \ PGSSLROOTCERT= \ psql -U doadmin -h -p -d defaultdb ``` **Connection string:** Pass the connection string from the Control Panel in quotes to `psql`. Replace ``, ``, ``, ``, and ``: ```shell psql "postgresql://:@:/defaultdb?sslmode=verify-full&sslrootcert=" ``` ### Connect with verify-full on Advanced Edition Advanced Edition clusters verify the server certificate against your system’s trust store. `libpq`-based clients such as `psql` also require `sslrootcert=system` in the connection URI. Use a PostgreSQL client with `libpq` 16 or later. Older `libpq` versions treat `system` as a filename and the connection fails. Clients that are not based on `libpq` and that trust the system store (for example, many Node.js PostgreSQL drivers) can use `sslmode=verify-full` without `sslrootcert=system`. The Control Panel copy action does not add `sslrootcert=system`. For connection strings, append `&sslrootcert=system` before you connect with `psql`. For Flags, set `PGSSLROOTCERT=system`, or use the examples below. **Flags format:** Paste the entire command from the Control Panel into your terminal. Replace ``, ``, and ``, and add `PGSSLROOTCERT=system`: ```shell PGPASSWORD= \ PGSSLMODE=verify-full \ PGSSLROOTCERT=system \ psql -U doadmin -h -p -d defaultdb ``` **Connection string:** Pass the connection string in quotes to `psql`. Replace ``, ``, ``, and ``. Include `sslrootcert=system` even if the Control Panel copy omitted it: ```shell psql "postgresql://:@:/defaultdb?sslmode=verify-full&sslrootcert=system" ``` When you connect successfully, your terminal changes to the `psql` prompt, which displays the name of the database you’re connected to, like `defaultdb=>`. At the `psql` prompt, you can change databases or users, execute SQL queries, and perform other database administration tasks. For common commands, see the [SQL cheat sheet](https://www.digitalocean.com/community/tutorials/how-to-manage-sql-database-cheat-sheet). For full reference, see the [official `psql` documentation](https://www.postgresql.org/docs/current/app-psql.html). If you’re having trouble connecting to the database, you can [troubleshoot the connection using our Support page](https://docs.digitalocean.com/support/postgresql/index.html.md), or you can reference [PostgreSQL connection parameter documentation](https://www.postgresql.org/docs/current/libpq-connect.html). ### Connect Using DataGrip To connect to a PostgreSQL database cluster using DataGrip, do the following: - Add your local computer [to the cluster’s trusted sources](https://docs.digitalocean.com/products/databases/postgresql/how-to/secure/index.html.md#firewalls). - Install the [DataGrip client](https://www.jetbrains.com/datagrip/) on your local computer. - Reference the [database cluster’s connection details](https://docs.digitalocean.com/products/databases/postgresql/how-to/connect/index.html.md#connection-details), which tell your client how to connect to the cluster. To connect to your PostgreSQL database using a standard TCP/IP connection, open DataGrip, click **File**, **New Data Source**, and then select **PostgreSQL** from the list of options. In the **Data Sources and Drivers** window, enter a descriptive name for the connection in the **Name** field. In the **General** tab, use the information from your cluster’s [**Connection Details**](https://docs.digitalocean.com/products/databases/postgresql/how-to/connect/index.html.md#connection-details) to fill out the necessary fields. ![DataGrip Data Sources and Drivers window with connection information](https://docs.digitalocean.com/screenshots/databases/postgresql-datagrip-connection.386c755c6ba3a4ea701bbb753625878ddcfd0aab88c3841c30b77b8c94ad3989.png) To connect using TLS, click the **SSH/SSL** tab. Select the **Use SSL** option. In the **Mode** field, select **Require**. You do not need a CA certificate file for this mode, which matches the default client `sslmode` setting in connection details (`require`). ![DataGrip Data Sources and Drivers SSL tab with connection information](https://docs.digitalocean.com/screenshots/databases/postgresql-datagrip-ssl.ca973c56ecd2e5a1bb22a5c7ad527d8b1d76b4ec5f130eec84414afca47c0f3d.png) On PostgreSQL Standard Edition clusters, to use full TLS certificate verification (`verify-full`), [download the CA certificate](https://docs.digitalocean.com/products/databases/postgresql/how-to/connect/index.html.md#download-the-ssl-certificate), enter its path in the **CA File** field, and change **Mode** to **Verify full**. On PostgreSQL Advanced Edition clusters, change **Mode** to **Verify full**. You do not need a CA certificate file because the client verifies the server certificate against your system’s trust store. When finished, click **Test Connection**. If you receive a message with a green checkmark, click **OK** in the **Data Sources and Drivers** window to save the connection configuration. DataGrip automatically connects to the database. If you receive an error, recheck that you entered your credentials correctly and then retry the test. If you’re having trouble connecting to the database, you can [troubleshoot the connection using our Support page](https://docs.digitalocean.com/support/postgresql/index.html.md), or you can reference [DataGrip’s connection documentation](https://www.jetbrains.com/help/datagrip/connecting-to-a-database.html).