Connect a live PostgreSQL database

What a live database connection does

A live connection lets Loam and permitted AI tools inspect and query your current PostgreSQL data. It does not copy, synchronize, or modify that database. Each connection appears beneath a workspace-owned path such as integrations.production_reporting.

A workspace can contain several PostgreSQL connections, including connections to the same server or database with different credentials and access policies.

Prepare PostgreSQL

1. Create a dedicated login with only the required schema usage and SELECT privileges.
2. Require TLS on the server and use a certificate valid for its DNS hostname.
3. Make the hostname publicly reachable. Private networks, SSH tunnels, and fixed Loam egress IPs are not supported yet.
4. If the certificate uses a private certificate authority, copy its CA certificate in PEM format.

PostgreSQL permissions are the first security boundary. Loam's policy can narrow those permissions, but cannot safely grant access that the database login does not already have.

Connect the database

1. Open Settings > Integrations (sign in to open this page).
2. Under Live databases, choose Add PostgreSQL.
3. Enter a display name and a lowercase integrations alias.
4. Enter the DNS hostname, port, database, read-only username, and password as separate fields. Do not paste a connection URL.
5. Optionally paste a private CA certificate, then test and connect.

Loam always uses full TLS hostname verification. IP-literal endpoints are rejected. The password and optional CA certificate are encrypted in the workspace's regional data plane and are never returned by the API or shown again.

Workspace access and management

Any current workspace member can add a database. All workspace members may browse and query it by default. The creator and workspace Admins can test, pause, resume, edit, restrict, replace credentials, or delete it. A connection remains owned by the workspace if its creator leaves.

Choose Restrict member queries when the database should not use the workspace-wide default. Explicit denies continue to win over broader access.

Browse and query in Loam

In Settings > Integrations (sign in to open this page), choose Browse structure to inspect cached schemas, tables, views, and columns the read-only login and Loam policy both allow. Choose Rescan to refresh that metadata. InRead-only query, choose the connection, enter one PostgreSQL SELECT or CTE, and choose Run query. Queries run against the live database and may therefore see newer data than an earlier scan.

The Loam catalog path identifies where the connection is mounted, for example integrations.production_reporting.public.orders. The SQL sent through the selected live connection uses the PostgreSQL relation name, such as public.orders. The connection selection already identifies the remote database.

Query from Database

1. Call list_database_connections and keep the returned connectionId.
2. Call search_database_schema when you need to find a relation, or describe_database_relation when you know its schema and name.
3. Call query_database with that exact connectionId and one selective, read-only PostgreSQL query.

These tools belong to the separate Database connection. Database uses your Loam account and workspace, but remains a distinct Claude listing and OAuth resource. The ordinary Loam execute_sql_query tool queries stored Loam Tables and is not the live-database query tool. Do not substitute a display name, integrations alias, or catalog path for the stable connection ID.

Loam rejects writes, DDL, session changes, locking reads, multiple statements, oversized results, and queries that exceed their time limit. A successful connection test proves the login works; it does not prove that every table is readable.

Rotate credentials or move an endpoint

Replace credentials submits a complete new username and password, validates them, and drains sessions using the old secret. Edit endpoint similarly requires the complete hostname, port, and database because saved values are redacted. Leave the CA field empty to preserve the current private CA, or supply a new PEM certificate to rotate it.

Pause or delete

Pausing immediately stops new live queries and drains active pools without deleting configuration. Deleting removes the encrypted secret and the corresponding integrations mount. Neither action changes the external PostgreSQL database itself.