Connect Postgres

Connect a Postgres database (or Supabase) to Arcus with a read-only role.

Last updated 2026-05-09

Arcus reads from Postgres with a read-only role. The same recipe works for vanilla Postgres, AWS RDS, Google Cloud SQL, Supabase, and Neon.

What Arcus needs

A reachable Postgres instance (TLS required for production).
A read-only role scoped to the schema(s) you want exposed.
A connection string with that role's credentials.

Postgres-side setup

Run these as a superuser or anyone with CREATE ROLE and grant privileges. Replace mydb and analytics with your database and schema.

-- 1. Create the role
CREATE ROLE arcus_reader WITH LOGIN PASSWORD 'use_a_long_random_password_here';

-- 2. Allow connecting to the database
GRANT CONNECT ON DATABASE mydb TO arcus_reader;

-- 3. Grant usage on the schema
GRANT USAGE ON SCHEMA analytics TO arcus_reader;

-- 4. Grant SELECT on all current and future tables/views
GRANT SELECT ON ALL TABLES IN SCHEMA analytics TO arcus_reader;
GRANT SELECT ON ALL SEQUENCES IN SCHEMA analytics TO arcus_reader;
ALTER DEFAULT PRIVILEGES IN SCHEMA analytics GRANT SELECT ON TABLES TO arcus_reader;
ALTER DEFAULT PRIVILEGES IN SCHEMA analytics GRANT SELECT ON SEQUENCES TO arcus_reader;

If you have multiple schemas to expose, repeat steps 3 and 4 for each.

SSL / TLS

Arcus requires TLS for all production Postgres connections. Most managed services (Supabase, RDS, Cloud SQL) enable it by default with a public CA. If you're running self-hosted Postgres, generate a server cert and require SSL:

-- in postgresql.conf
ssl = on
ssl_cert_file = '/etc/postgresql/server.crt'
ssl_key_file = '/etc/postgresql/server.key'

Arcus accepts the connection string parameter ?sslmode=require (verifies cert chain) or ?sslmode=verify-full (additionally verifies hostname).

Network access

Arcus's compute runs from Vercel's egress range. If your Postgres instance has a security group, allow inbound on port 5432 (or your custom port) from Vercel egress IPs. Email hello@usearcus.ai for the current egress list.

For Supabase databases, the public connection (port 5432 or pooled 6543) is reachable from us by default — no allowlisting needed.

Arcus-side setup

In Arcus, open Settings → Connections → Add a connection and pick Postgres. Fill in:

Connection name — readable label.

Connection string — full URI with the arcus_reader credentials, e.g.

postgres://arcus_reader:long_random_password@db.example.com:5432/mydb?sslmode=require

Click Save. Arcus runs SELECT 1 to verify.

For Supabase: use the direct connection string from your Supabase project settings (not the pooled URL — Arcus needs prepared statements).

Common errors

password authentication failed for user — the password in the connection string doesn't match what you set with CREATE ROLE. Reset with ALTER ROLE arcus_reader WITH PASSWORD 'new_password'.

permission denied for schema — the role is missing USAGE on the schema. Re-run the grant.

pg_hba.conf rejects connection — the Postgres host is configured to reject connections from our IP. Add a line to pg_hba.conf allowing the role from the Arcus egress range, or add a security group rule.

server does not support SSL — your Postgres isn't configured for TLS. Either fix that (recommended for any prod database) or downgrade to ?sslmode=disable — Arcus refuses to connect over plaintext for tenants on the Growth plan and above.

Cost

Postgres connections don't cost per query — your bill is the database itself. Arcus's queries are cheap, but if you're on RDS or Cloud SQL, every connection is a small idle cost. We use connection pooling and a max of 2 connections per tenant, so it's negligible.

Test the connection

Click Discover schema. Arcus lists every schema, table, and column the role can SELECT. If you expected a table to appear and it didn't, check \\dp tablename in psql — the role probably doesn't have SELECT on it.

Connect BigQuery