> ## Documentation Index
> Fetch the complete documentation index at: https://dreamlit.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect your database

> What your database needs for Dreamlit Autopilot: PostgreSQL 14 or newer, logical replication enabled, and a read-only user. Two SQL statements, no code.

Autopilot connects to your database with a read-only user, the same way analytics platforms do. Setup is two SQL statements and a connection string. During onboarding we do this together on a call; this page is what your database team needs to prepare ahead of time.

<Tip>
  **On Supabase?** Logical replication is already enabled on Supabase projects.
  You only need to create the user below in the SQL editor and share the direct
  connection string.
</Tip>

## Requirements

* **PostgreSQL 14 or newer.** Supabase, Neon, Amazon RDS and Aurora, Google Cloud SQL, and most managed providers qualify.
* **Logical replication enabled.** This is the built-in PostgreSQL setting that exposes the change feed Autopilot reads, and the same setting analytics tools such as Fivetran and Airbyte ask for. See [Enable logical replication](#enable-logical-replication) below.
* **A direct connection host.** Use your provider's direct database host (typically port `5432`), not a transaction pooler host. Pooled connections cannot follow the change feed.

If you are unsure whether your provider qualifies, [ask us](/docs/resources/getting-support) and we will check with you.

## Enable logical replication

| Provider                           | What to do                                                                                            |
| ---------------------------------- | ----------------------------------------------------------------------------------------------------- |
| **Supabase**                       | Already enabled. Nothing to do.                                                                       |
| **Neon**                           | Turn on **Logical replication** in your project settings.                                             |
| **Amazon RDS**                     | Set `rds.logical_replication` to `1` in a custom parameter group and reboot the instance.             |
| **Amazon Aurora**                  | Set `rds.logical_replication` to `1` in the cluster parameter group and reboot.                       |
| **Google Cloud SQL**               | Set the `cloudsql.logical_decoding` flag to `on` and restart.                                         |
| **Azure Database for PostgreSQL**  | Set the `wal_level` server parameter to `logical` and restart.                                        |
| **Self-hosted or other providers** | Set `wal_level = logical` and restart PostgreSQL, or ask your provider to enable logical replication. |

## Create the Autopilot user

Run these two statements as a role that can create roles (for example `postgres`), replacing `<SECRET_PASSWORD>` with a [strong, unique password](https://1password.com/password-generator):

```sql theme={null}
CREATE ROLE dreamlit_autopilot WITH LOGIN REPLICATION INHERIT NOBYPASSRLS NOCREATEDB NOCREATEROLE PASSWORD '<SECRET_PASSWORD>';
GRANT pg_read_all_data TO dreamlit_autopilot;
```

What this gives Autopilot, and nothing more:

* **Read access to your tables**, through `pg_read_all_data`, the read-only role built into PostgreSQL.
* **Permission to follow the change feed**, through `REPLICATION`.

The user can't insert, update, delete, or alter anything, and can't create databases or other users. Dreamlit never modifies your data.

<Note>
  It is best practice to create a separate database user for each service that
  connects to your database. That way you can see exactly what each one is
  allowed to do, and revoke any of them independently.
</Note>

## Share the connection string

Put the user and password into a standard connection string using your **direct** database host:

```
postgresql://dreamlit_autopilot:<SECRET_PASSWORD>@<DIRECT_HOST>:5432/<DATABASE_NAME>
```

SSL is always on for Autopilot connections, with the certificate verified. You do not need to add any SSL parameters to the string.

Share it with us through the onboarding form or your Dreamlit dashboard. Credentials are encrypted at rest and never displayed in plaintext. See [Security](/docs/resources/security) for the full picture.

<AccordionGroup>
  <Accordion title="My database only accepts connections from allowlisted IP addresses">
    [Contact support](/docs/resources/getting-support) and we will share the
    addresses Autopilot connects from.
  </Accordion>

  <Accordion title="Some of my tables use row level security (RLS)">
    Tell us during onboarding. Row level security applies to queries, not to the
    change feed, so Autopilot handles RLS-protected tables differently. We'll go
    through which tables your funnel needs and agree on how to include them.
  </Accordion>

  <Accordion title="I use Supabase Auth">
    Autopilot can read signups and logins from Supabase Auth's tables the same
    way it reads the rest of your database. If you also want Dreamlit to send
    your auth emails (magic links, password resets), that is set up separately;
    see the [Supabase Auth emails guide](/docs/guides/supabase-auth-emails).
  </Accordion>
</AccordionGroup>

## Removing access

You can revoke Autopilot's access at any time, in two steps.

<Warning>
  **Remove the connection first.** Remove it in your Dreamlit dashboard, or ask
  us to, before dropping the user. Dropping the user while the connection is
  still active leaves Autopilot's place in the change feed open, and your
  database keeps holding on to change history it no longer needs.
</Warning>

Once the connection is removed, drop the user:

```sql theme={null}
DROP ROLE dreamlit_autopilot;
```

***

Last validated: 2026-09-08