Direct SQL access

Point psql, ORMs, and migration tools at a real PostgreSQL connection using short-lived connection tickets.

Issue a ticket

On the project's Overview page in the dashboard, click New connection ticket (project owners and org admins only). You get a ready-to-paste URI:

psql "postgres://kbt_…:…@db.kethosbase.com:5432/p<ref>?sslmode=require"

How tickets work

A ticket is a real PostgreSQL role that can log in for 15 minutes; connect within the window and your session stays open after it closes (up to a 12-hour cap, 2 concurrent connections).
The session runs as the project owner — full DDL and DML, Row-Level Security bypassed — the same trust level as the dashboard SQL editor. Objects you create belong to the project, not the ticket.
Need a fresh connection later? Issue a new ticket — they are meant to be disposable, and every issuance lands in the org audit log.

Requirements and limits

Item	Value
Host	`db.kethosbase.com:5432`
TLS	Required (`sslmode=require` or stricter)
Login window	15 minutes per ticket
Connections per ticket	2
Session lifetime	12 hours maximum

Only connection tickets can authenticate on the public port — project API roles and keys never work here, and a ticket only reaches its own project's database.

TLS and certificates

Every connection is encrypted — the URI carries sslmode=require and a plaintext connection is refused. You do not need a client certificate: you authenticate with the ticket (or durable-credential) password, never a certificate.

If your client asks for a CA / root certificate, it is trying to verify the server — and you still don't need to download a file. db.kethosbase.com presents a publicly trusted certificate, so your operating system already trusts it out of the box.

sslmode=require — encrypts the connection; this is what the dashboard hands you. No certificate needed.
sslmode=verify-full — also authenticates the server (recommended for production). Works against your system's default CA store; only if your machine has none do you point sslrootcert at it (for example /etc/ssl/certs/ca-certificates.crt).

In a GUI client (DBeaver, TablePlus, pgAdmin, DataGrip), set the SSL mode to require or verify-full, leave the CA / root certificate on system default — do not upload a file — and make sure any "client certificate" or mutual-TLS option is off: the server never asks for one.

Durable credentials

Tickets are disposable and short-lived — ideal for a person at a psql prompt or a one-off migration. For an application's long-lived connection pool, a project can instead issue a durable credential (kbd_…): a stable connection string that does not expire on a 15-minute window or a 12-hour cap.

psql "postgres://kbd_…:…@db.kethosbase.com:5432/p<ref>?sslmode=require"

It connects through the same secure endpoint and runs as the project owner; the per-credential connection cap defaults to 20 and can be raised for a busy pool. The password is shown once at creation and is never stored — save it when you mint the credential.

Enabling durable credentials

Durable credentials are off by default and gated per project by a flag (durable_sql_enabled): while it is off, the mint endpoint answers 403 and the public port accepts ephemeral tickets only. This keeps a stable database password off the public port for projects that don't need one. The flag is enabled per eligible project — contact us to turn it on. Once enabled, an owner or org admin mints and revokes kbd_ credentials for the project; revoking one drops the role immediately, and both actions are recorded in the org audit log.

A durable credential is valid until revoked (unlike a ticket's 15-minute window), so treat it like any production database secret. TLS is required on every connection — the connection string carries sslmode=require (or stricter); a non-TLS connection is refused.

Example: run a migration

# Issue a ticket in the dashboard, then:
psql "postgres://kbt_…:…@db.kethosbase.com:5432/p<ref>?sslmode=require" \
  -f migrations/001_init.sql