Setting Up Retool for Database Integration
Connecting Retool to a database requires resource setup, access configuration, and secure connection setup. Retool works with PostgreSQL, MySQL, Microsoft SQL Server, MongoDB, Redis, Google BigQuery, and others.
PostgreSQL Connection
In Retool → Resources → Create New → PostgreSQL:
Host: db.production.example.com
Port: 5432
Database name: app_production
Database username: retool_readonly
Password: ****
SSL mode: require
Creating a separate user with limited privileges:
-- Read-only user
CREATE USER retool_readonly WITH PASSWORD 'secure_password';
GRANT CONNECT ON DATABASE app_production TO retool_readonly;
GRANT USAGE ON SCHEMA public TO retool_readonly;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO retool_readonly;
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO retool_readonly;
-- Separate user for write operations (for specific tables)
CREATE USER retool_ops WITH PASSWORD 'another_password';
GRANT SELECT, UPDATE ON users TO retool_ops;
GRANT SELECT, INSERT, UPDATE ON support_tickets TO retool_ops;
Secure Connection via SSH Tunnel
If database doesn't have public IP:
Enable SSH tunnel: YES
SSH host: bastion.example.com
SSH port: 22
SSH username: retool-tunnel
SSH private key: [insert key]
On bastion:
# Allow only port forwarding, no shell
Match User retool-tunnel
ForceCommand /bin/false
PermitTunnel yes
AllowTcpForwarding yes
Parameterized Queries
Retool substitutes component values into the query:
UPDATE users
SET status = {{ statusSelect.value }},
updated_at = NOW(),
updated_by = {{ current_user.email }}
WHERE id = {{ usersTable.selectedRow.data.id }}
AND status != {{ statusSelect.value }}
Variables in {{ }} are escaped—SQL injections excluded.
Timeline
Connection setup and first 3–5 queries — 1 day.