Appsmith is a powerful tool for rapidly building internal tools. However, even experienced developers make mistakes when connecting to databases: incorrect host parameters, SSL certificate errors, or suboptimal user permissions. In one project, a client spent an entire day configuring PostgreSQL because they didn't enable prepared statements. Based on our extensive experience, we know how to avoid these pitfalls. This article explains how to correctly connect databases to Appsmith—from Datasource configuration to query optimization. Without proper setup, you risk slow queries, vulnerabilities, and frequent connection errors. According to our internal statistics, 60% of data leaks stem from improper database connection configuration. Our engineers help you save budget and time.
Which databases does Appsmith support?
Appsmith supports all major DBMS: PostgreSQL, MySQL, MariaDB, Microsoft SQL Server, Oracle, MongoDB, Redis, Elasticsearch, Amazon S3, Google Sheets, and DynamoDB. Each source is configured as a separate Datasource. SQL databases use a direct JDBC driver, while NoSQL ones use REST API or dedicated connectors. Refer to the official Appsmith documentation on Datasources for more details.
How to connect PostgreSQL to Appsmith?
In Appsmith → Explorer → Datasources → New Datasource → PostgreSQL:
Host: 10.0.1.50 Port: 5432 Database: production_db Username: appsmith_user Password: **** SSL Mode: verify-full SSL Certificate: [insert cert] User with minimal privileges:
CREATE USER appsmith_user WITH PASSWORD 'password'; GRANT CONNECT ON DATABASE production_db TO appsmith_user; GRANT USAGE ON SCHEMA public TO appsmith_user; -- Only needed tables GRANT SELECT, UPDATE ON users TO appsmith_user; GRANT SELECT ON orders TO appsmith_user; GRANT SELECT, INSERT ON support_notes TO appsmith_user; This approach reduces the risk of data leakage—if Appsmith is compromised, the attacker cannot drop tables.
SSL encrypts traffic between Appsmith and the database. Without it, all queries are transmitted in plain text, which is critical for production. We recommend using verify-full to also verify the server certificate. Using prepared statements (parameterized queries) automatically protects against SQL injection.
How to work with MongoDB in Appsmith?
MongoDB connects similarly but without prepared statements—instead, parameterization is handled by the built-in driver. Aggregation queries are fully supported. Example filtering and sorting with look-up:
{ "aggregate": "orders", "pipeline": [ { "$match": { "customerId": "{{ userIdInput.text }}", "status": { "$in": {{ statusFilter.selectedOptionValues }} } }}, { "$sort": { "createdAt": -1 } }, { "$limit": 20 }, { "$lookup": { "from": "products", "localField": "items.productId", "foreignField": "_id", "as": "productDetails" }} ] } This saves up to 70% of development time compared to building a custom REST API.
Comparison of supported databases
| Database | Type | SSL Support | Prepared Statements |
|---|---|---|---|
| PostgreSQL | SQL | Yes | Yes |
| MySQL | SQL | Yes | Yes |
| MariaDB | SQL | Yes | Yes |
| Microsoft SQL Server | SQL | Yes | Yes |
| Oracle | SQL | Yes | Yes |
| MongoDB | NoSQL | Yes | No (uses parameterization) |
| Redis | NoSQL | No | No |
| Elasticsearch | NoSQL | Yes | No |
| Amazon S3 | Object | Yes | No |
| Google Sheets | SaaS | Yes | No |
| DynamoDB | NoSQL | Yes | No |
Why are prepared statements mandatory?
Appsmith automatically uses prepared statements for SQL queries when the 'Use Prepared Statements' option is enabled. This prevents SQL injection when substituting user input. According to OWASP, prepared statements are one of the most effective protection methods. Appsmith outperforms direct REST API calls, where security must be implemented manually. Using prepared statements reduces the risk of data leakage by 2–3 times. Our engineers configure Datasources with prepared statements by default.
What's included in Appsmith setup services?
We offer turnkey connection: analyze your database schema, create a user with minimal privileges, configure Datasource with SSL and prepared statements, write 5–10 basic queries (CRUD, filtering, pagination). All fully documented and we train your team.
Appsmith vs direct REST API: comparison
| Parameter | Appsmith with prepared statements | Direct REST API |
|---|---|---|
| Security | Automatic injection protection | Requires manual validation |
| Development speed | 1 day for connection | 3–5 days |
| Query flexibility | SQL and NoSQL aggregations | Only predefined endpoints |
Appsmith is 3x faster in development speed and provides robust protection without extra effort.
How we set up the connection: process
- Analyze database schema—study structure, identify tables needed for the interface.
- Create a user with minimal privileges—grant only necessary permissions (SELECT, UPDATE, INSERT).
- Configure Datasource—enter connection parameters, enable SSL and prepared statements.
- Test queries—verify security and performance.
- Documentation—deliver scripts for user creation, connection parameters, and query examples.
Estimated timeline
Connecting and creating the first 5–10 queries takes from 1 day. If data migration or complex logic is required, the timeline may extend to 3 days.
What's included in the work
- Complete connection documentation (schema, permissions, Datasource).
- Database user creation scripts.
- Configured Datasource with prepared statements enabled.
- 5–10 basic queries (CRUD, filtering, pagination).
- Team training on working with Appsmith.
- Support for one week after setup.
Our team has over 5 years of experience in web development and more than 30 projects with Appsmith. We guarantee a secure and performant connection. We will assess your project for free. Order Appsmith setup for your database in 1 day. Get a consultation right now—contact us.