Connection URL Reference

Two readers take these URLs, and not the same set. The Import from URL… sheet accepts every scheme in this reference, while open and browser links reach TablePro only through the ones it registers with macOS.

Import from URL sheet with a pasted connection URL — The Import from URL sheet accepts every scheme in this reference

URL schemes

Scheme	Database	`open`
`postgresql://`	PostgreSQL	Yes
`postgres://`	PostgreSQL (alias)	Yes
`mysql://`	MySQL	Yes
`mariadb://`	MariaDB	Yes
`tidb://`	TiDB	Yes
`oceanbase://`	OceanBase	Yes
`sqlite://`	SQLite	Yes
`mongodb://`	MongoDB	Yes
`mongodb+srv://`	MongoDB (SRV)	Yes
`redis://`	Redis	Yes
`rediss://`	Redis with TLS	Yes
`redshift://`	Amazon Redshift	Yes
`cockroachdb://`	CockroachDB	Yes
`cockroach://`	CockroachDB (alias)	Yes
`pglite://`	PGlite	No
`mssql://`	Microsoft SQL Server	Yes
`sqlserver://`	Microsoft SQL Server (alias)	Yes
`jdbc:sqlserver://`	Microsoft SQL Server (JDBC)	No
`oracle://`	Oracle Database	Yes
`dm://`	Dameng DM8	Yes
`hdb://`	SAP HANA	No
`jdbc:oracle:thin://`	Oracle Database (JDBC thin)	No
`cassandra://`	Cassandra	Yes
`cql://`	Cassandra (alias)	Yes
`scylladb://`	ScyllaDB	Yes
`scylla://`	ScyllaDB (alias)	Yes
`clickhouse://`	ClickHouse	Yes
`ch://`	ClickHouse (alias)	Yes
`teradata://`	Teradata	No
`trino://`	Trino	No
`duckdb://`	DuckDB file	Yes
`quack://`	DuckDB remote (Quack protocol)	No
`beancount://`	Beancount ledger file	No
`etcd://`	etcd	Yes
`etcds://`	etcd with TLS	Yes
`d1://`	Cloudflare D1	Yes
`libsql://`	libSQL / Turso	Yes
`surrealdb://`	SurrealDB	Yes

Import from URL… also takes a JDBC URL: jdbc: in front of a scheme above, such as jdbc:trino:// or jdbc:postgresql://, is dropped. user and password parameters fill in the credentials when the URL has none before the host, as in jdbc:postgresql://db.example.com/app?user=analyst. A JDBC form with a protocol segment, such as jdbc:ch:http://, is not recognized. Append +ssh to any non-file scheme (so not sqlite, duckdb, or beancount) to carry SSH settings in the same string:

postgresql+ssh://
mysql+ssh://
mariadb+ssh://

No +ssh scheme is registered with macOS, so open and browser links cannot route one. Import those through the sheet.

Standard format

scheme://[username[:password]@]host[:port][/database][?param=value&…]

postgresql://alice:secret@db.example.com:5432/myapp
mysql://root@localhost/shop
mongodb://user:pass@mongo.host:27017/analytics?authSource=admin
redis://:password@cache.host:6379/1
sqlite:///Users/alice/data/local.db

If the URL is already in a project’s .env file, Open Project Folder reads it for you instead of asking you to paste it.

Passwords containing @, #, %, or : must be percent-encoded. p@ss#word becomes p%40ss%23word.

A URL the parser cannot read is reported as Could not parse database URL: …, with the password stripped out of the echoed string.

SSH tunnel format

Both sets of credentials go in one string, SSH first:

scheme+ssh://[ssh_user@]ssh_host[:ssh_port]/[db_user[:db_pass]@]db_host[:db_port][/database][?params]

postgresql+ssh://deploy@bastion.host:22/dbuser:dbpass@internal-pg:5432/mydb
mysql+ssh://ec2-user@jump.host/root:secret@10.0.0.5/shop
mariadb+ssh://admin@ssh.host/maria_user@db.internal/store?usePrivateKey=true

An omitted db_host defaults to 127.0.0.1.

Query parameters

Names are matched case-insensitively. Anything unrecognized is ignored, except on a MongoDB URL, where every unknown parameter is passed to the driver unchanged.

Connection

Parameter	Description	Example
`name`	Connection name shown in the sidebar, and part of what a trusted link is matched on	`?name=Production+DB`
`safeModeLevel`	Safe Mode for this connection: 0=silent, 1=alert, 2=read-only	`?safeModeLevel=2`
`statusColor`	Connection color as hex, matched to the nearest palette color	`?statusColor=FF3B30`
`env`	Assign an existing tag by name. `environment` is accepted too	`?env=production`
`socket`	MySQL and MariaDB. Socket file path, in place of host and port. Alias `unix_socket`. See Unix socket	`?socket=%2Ftmp%2Fmysql.sock`

Unix socket

mysql://root@localhost/shop?socket=%2Ftmp%2Fmysql.sock
mariadb://root@/shop?socket=(/tmp/mysql.sock)

Works only with host localhost or no host.
Any other host, 127.0.0.1 included, ignores socket and uses TCP.
Percent-encode the path, or wrap it in parentheses.
+ reads as a space. Write a literal + as %2B.
The path must start with / and fit in 103 bytes.
A path with a control or invisible character refuses the URL.
Other engines and +ssh URLs ignore socket.
Copy Connection String writes this form, with no port.

SSL/TLS

Parameter	Values	Description
`sslmode`	`disable`, `prefer`, `require`, `verify-ca`, `verify-full`	SSL mode under libpq’s names, in any case and with `_` for `-`, so `VERIFY_FULL` works too. ClickHouse JDBC’s `strict` and `none` read as Verify Identity and Required
`tlsmode`	`0`-`4`	The same modes as integers: 0=disable, 1=prefer, 2=require, 3=verify-ca, 4=verify-full
`tls` / `ssl`	`true`, `false`	`true` turns TLS on: Verify Identity for Trino and ClickHouse, Required for every other database. `false` sets Disabled, even on a port that means TLS
`SSLVerification`	`FULL`, `CA`, `NONE`	Trino’s certificate check once TLS is on: Verify Identity, Verify CA, Required. Ignored while TLS is off. Verify CA also needs a CA certificate file

sslmode or tlsmode wins over ssl, tls and SSLVerification. With none of them, a Trino URL on port 443 and a ClickHouse URL on 443 or 8443 import as Verify Identity, as in Ports that mean TLS, and every other URL takes the driver’s default from Per-driver defaults. Import from URL… and a link opened from a browser or open resolve the mode the same way, so ssl=false or sslmode=disable is how a link asks for plain TCP. A URL that turns TLS on and names no port opens on the driver’s TLS port, 443 for Trino and 8443 for ClickHouse, and a port written in the URL is kept.

postgresql://user:pass@host/db?sslmode=require
postgresql://user:pass@host/db?tlsmode=2

Parameter	Description	Example
`table`	Open this table once connected	`?table=users`
`view`	Open this view once connected	`?view=active_orders`
`schema`	Switch here first	`?schema=reporting`

On PostgreSQL, Redshift, SQL Server, and Oracle, schema switches the schema. Everywhere else the value is read as a database name and switches the database.

postgresql://user:pass@host/mydb?schema=reporting&table=monthly_sales

Filtering

These open the table in a new tab with the filter applied, so a tab already showing that table keeps its own filters. A link carrying a filter always asks first, even for a trusted database, and the alert shows the whole filter. A filter longer than 51,200 characters is refused.

Parameter	Description	Example
`column`	Column to filter on	`?column=status`
`operation`	Filter operator. Symbols and names both work (`=`, `LIKE`, `Equal`, `Contains`, `Is Null`); `operator` is an alias for the parameter	`?operation=LIKE`
`value`	Filter value	`?value=active`
`condition`	Raw SQL WHERE condition, which overrides `column`, `operation`, and `value`. `raw` and `query` are aliases	`?condition=status%3D'active'`

postgresql://user:pass@host/mydb?table=orders&column=status&operation==&value=pending
postgresql://user:pass@host/mydb?table=orders&condition=total%3E1000

SSH tunnel

Parameter	Description
`usePrivateKey`	`true` for key-based SSH authentication
`useSSHAgent`	`true` to authenticate through an SSH agent
`sshNoAuth`	`true` to send no credentials at all, for servers like Tailscale SSH. See Authentication methods
`agentSocket`	Path to a non-default agent socket

postgresql+ssh://ubuntu@bastion/dbuser@10.0.0.5/mydb?usePrivateKey=true

MongoDB

Parameter	Description
`authSource`	Authentication database, `admin` by default
`authMechanism`	For example `SCRAM-SHA-256`
`replicaSet`	Replica set name

Comma-separated hosts work for a replica set URI.

mongodb://user:pass@host:27017/mydb?authSource=admin
mongodb://user:pass@host1:27017,host2:27017,host3:27017/mydb?replicaSet=rs0

What the path component means

The part after the host is the database name on most schemes. Seven read it differently:

Scheme	The path is
`redis://`, `rediss://`	The database index, from 0 to 2147483646, and 0 when omitted. `db2` reads as 2, and any other path is refused
`cassandra://`, `scylladb://`	The default keyspace. Omit it to connect with none
`sqlite://`, `duckdb://`, `beancount://`	An absolute file path, so the URL carries three slashes
`quack://`	The alias a remote DuckDB server attaches the database under. See DuckDB
`d1://`	The D1 database name or UUID, with the host as the Cloudflare account ID
`libsql://`	Nothing. The host is the database URL, and the auth token goes in the connection form’s password field

redis://:password@host:6379/2
cassandra://user:pass@host:9042/my_keyspace
duckdb:///Users/me/data/analytics.duckdb
quack://host:9494/alias
d1://account-id/database-name
libsql://your-database.turso.io

When another client also handles the scheme, open -b com.TablePro "mysql://…" forces TablePro. See Terminal for the tablepro command and DDEV for ddev tablepro.

Confirmation and trusted links

Every URL opened from outside the app raises an Open External Database Connection? alert naming the database type, host and port or socket, user, and database. Connect does not answer the Return key. Escape is the only keyboard answer, and it cancels. Always Allow appears only for a database on this machine (localhost, 127.x.x.x, ::1, or a socket). A trusted link is matched on database type, host, socket, database, username, and the URL’s name parameter, never the port, so the same link on a different port still connects without asking again. Trusting localhost does not cover a socket link. Trusting one socket does not cover another. Remote hosts always prompt, and so does a link through an SSH tunnel, whose database is on the SSH server. A link with a filter asks every time and offers no Always Allow. Read the filter in the box under the target before choosing Connect: it runs on the table as soon as the connection opens. Trusted links are listed under Settings > General, where Forget drops one and Forget All drops every one.

Start here

Connections

Databases

Write SQL

Browse and edit data

Schema and server

Import and export

AI

Integrations

Around the app

Sync and licensing

Customization

iPhone and iPad

Security and privacy

Connection URL Reference

URL schemes

Standard format

SSH tunnel format

Query parameters

Connection

Unix socket

SSL/TLS

Navigation

Filtering

SSH tunnel

MongoDB

What the path component means

Confirmation and trusted links

​URL schemes

​Standard format

​SSH tunnel format

​Query parameters

​Connection

​Unix socket

​SSL/TLS

​Navigation

​Filtering

​SSH tunnel

​MongoDB

​What the path component means

​Confirmation and trusted links

URL schemes

Standard format

SSH tunnel format

Query parameters

Connection

Unix socket

SSL/TLS

Navigation

Filtering

SSH tunnel

MongoDB

What the path component means

Confirmation and trusted links