Cloud providers

Each recipe says what to put in each field of New connection for one provider. Cloud consoles change, so each one carries the date it was last checked against the provider’s own documentation. Copy host names and ports from your provider’s console rather than building them by hand.

The recipes lean on three other pages: TLS and sslmode for the Encryption settings, Passwords from a command for IAM and Entra tokens, and Connection poolers for pooled endpoints.

Amazon RDS and Aurora

Last checked: 2026-11

Field	Value
Host	The endpoint, such as mydb.abc123xyz.eu-west-1.rds.amazonaws.com. For Aurora, the cluster endpoint (….cluster-….rds.amazonaws.com) writes; the reader endpoint (….cluster-ro-….rds.amazonaws.com) only reads.
Port	5432, unless you chose another
Encryption	Required, verify server
CA certificate	AWS’s global-bundle.pem, downloaded

Sign in with IAM

RDS can take a short-lived IAM token in place of a password. Alcuin does not make the token itself; it runs the AWS CLI for it.

1. Sign in to AWS in a terminal first, for example with aws sso login.

2. Set Authentication to Password from command, and Command to:

   aws rds generate-db-auth-token --hostname mydb.abc123xyz.eu-west-1.rds.amazonaws.com --port 5432 --username app --region eu-west-1

   --hostname is the endpoint, even when Host is something else, such as a port forward on localhost.

3. If you use a named AWS profile, set Variables to AWS_PROFILE=prod.

4. Keep Encryption at Required, verify server with the CA bundle. Alcuin sends a token the server asks for in clear text only over TLS that checks the certificate.

The database user must be granted the rds_iam role. A token lasts 15 minutes; Alcuin reuses it for 10 by default.

Through a bastion host

Set up Connect through SSH with the bastion as SSH host, and keep Host as the RDS endpoint: the bastion resolves it. Required, verify server still works, because Alcuin checks the certificate against Host. See SSH tunnels.

Through Session Manager

Alcuin does not start AWS Systems Manager sessions. Start a port forward in a terminal, then connect Alcuin to it:

aws ssm start-session --target i-0123456789abcdef0 \
  --document-name AWS-StartPortForwardingSessionToRemoteHost \
  --parameters '{"host":["mydb.abc123xyz.eu-west-1.rds.amazonaws.com"],"portNumber":["5432"],"localPortNumber":["15432"]}'

Set Host to localhost and Port to 15432. The certificate names the RDS endpoint, not localhost, so choose Required, verify certificate with the CA bundle.

Supabase

Last checked: 2026-11

Supabase offers a direct connection and a shared pooler. The project’s Connect dialog shows each one’s host and user.

Connection	Host	Port	User
Direct	db.<project-ref>.supabase.co	5432	postgres
Shared pooler, session mode	aws-<n>-<region>.pooler.supabase.com	5432	postgres.<project-ref>
Shared pooler, transaction mode	aws-<n>-<region>.pooler.supabase.com	6543	postgres.<project-ref>

Which to use:

• Direct, when your network reaches it. Supabase serves the direct host over IPv6 unless the project has its IPv4 add-on.
• The shared pooler in session mode, when your network has IPv4 only. It is reachable over IPv4 on every plan.
• Avoid transaction mode for Alcuin. Between transactions, each statement can run in a different server session, so SET and the settings Alcuin makes per session do not carry over. See Connection poolers.

Alcuin treats port 6543 on a Supabase host as a pooler, and reads each result there in one go instead of paging through it. Session mode on port 5432 keeps one server session, so Alcuin pages through results as it does on a direct connection.

For encryption, download the server root certificate from the project’s database settings, set CA certificate to it, and choose Required, verify server.

Neon

Last checked: 2026-11

Field	Value
Host	The direct endpoint, such as ep-cool-darkness-123456.us-east-2.aws.neon.tech
Port	5432
Encryption	Required, verify server, with no CA file

Neon refuses unencrypted connections. Its certificates come from Let’s Encrypt, a public authority, so no CA file is needed.

The pooled endpoint has -pooler after the endpoint ID (ep-cool-darkness-123456-pooler.us-east-2.aws.neon.tech) and runs PgBouncer in transaction mode. Prefer the direct endpoint for Alcuin; see Connection poolers.

Neon’s connection strings include channel_binding=require. Alcuin ignores it when you paste the URL; see TLS and sslmode.

A Neon compute that has scaled to zero starts when you connect, so the first connect after a quiet spell takes longer. Alcuin waits up to 15 seconds.

Azure Database for PostgreSQL

Last checked: 2026-11

For Flexible Server:

Field	Value
Host	<server>.postgres.database.azure.com
Port	5432
Encryption	Required, verify server, with no CA file

Azure’s certificates chain to public authorities, so no CA file is needed.

Sign in with Microsoft Entra ID

1. Sign in with az login in a terminal first.

2. Set User to your Entra user principal name, such as ana@contoso.onmicrosoft.com, or the name of an Entra group mapped in the database. Names are case-sensitive.

3. Set Authentication to Password from command, and Command to:

   az account get-access-token --resource-type oss-rdbms --query accessToken --output tsv

4. Keep Encryption at Required, verify server.

An Entra token lasts between 5 and 60 minutes. Alcuin reuses it for 10 minutes by default; set Reuse the password for lower if your tokens are short.

Cloud SQL

Last checked: 2026-11

Through the Cloud SQL Auth Proxy

The Auth Proxy encrypts the connection to the instance and verifies it for you. Start it in a terminal:

cloud-sql-proxy my-project:europe-west1:my-instance

Then set Host to localhost, Port to 5432, and Encryption to Off or Preferred: the hop from Alcuin to the proxy stays on this machine.

To sign in with IAM, start the proxy with --auto-iam-authn. The proxy then signs in for you, and the connection needs no password. Set User to your Google account’s email, or for a service account, its email without .gserviceaccount.com.

Directly

Field	Value
Host	The instance’s IP address
Port	5432
Encryption	Required, verify certificate
CA certificate	The instance’s server-ca.pem, downloaded from the instance

If the instance requires client certificates, set Client certificate and Client key to the files Cloud SQL gives you for a client.

To sign in with IAM without the proxy, set Authentication to Password from command and Command to gcloud sql generate-login-token, after signing in with gcloud auth login in a terminal. Keep Encryption at Required, verify certificate with the CA file: Alcuin sends a token the server asks for in clear text only over TLS that checks the certificate.

If a recipe does not connect

Test connection names the step that failed. Connection errors by message has each message and its fix, including a failed password command.