> ## Documentation Index > Fetch the complete documentation index at: https://datagen.dev/llms.txt > Use this file to discover all available pages before exploring further. # Connect a Data Source > Add a PostgreSQL, MySQL, Oracle or Parquet on S3 connection, choose its tables and browse the catalog A connection holds the host, database and credentials for one database or S3 bucket. After you save it, you choose which tables become **sources** that analytic models can read. Only workspace **Admins** can add, edit or delete connections. ## Before you start * **Use a read-only account.** Create a database role that can only `SELECT` the tables you plan to register. Every query runs as this role and sees everything it can read. For PostgreSQL, the role setup in [Query a database from code](/data/query-from-code#1-create-a-read-only-user) works as is. * **Allow the host.** The analytics service connects only to hosts on the deployment's allowlist. A deployment administrator manages it under **Admin -> Data Source Hosts**. * **Make it reachable.** The database must be reachable from the DataGen analytics service over the network (public endpoint, VPN, peering, or the same private network for on-prem deployments). ## Add a connection Go to **Data -> Connections** and click **Connect source**. Pick **PostgreSQL**, **MySQL / MariaDB**, **Oracle Database** or **Parquet / S3** under **Source type**. (**Workspace files** is covered in [Build analytic models](/data/build-models#file-sources).) Enter a **Connection name**. Database connections also get a **SQL alias**, the middle part of every source's SQL name (`data...`). It defaults to the name, uses lowercase letters, digits and underscores, must be unique in the workspace, and cannot change later. Use the fields for your provider (see the tabs below) and choose a **TLS** mode. Click **Save connection**. DataGen connects with the credentials before saving: a wrong host, port or password fails here with the database's error message. ### Fields by provider | Field | Notes | | - | - | | **Host**, **Port** | Port defaults to `5432`. | | **Database** | The database to connect to. | | **Username**, **Password** | The read-only role. Stored encrypted. | | **Schemas (comma-separated)** | Schemas whose tables you can register. Defaults to `public`. | | **TLS** | **Verify certificate and hostname** (default), **Require TLS**, **TLS when available (private network)**, **No TLS (private development only)**. | | Field | Notes | | - | - | | **Host**, **Port** | Port defaults to `3306`. | | **Database** | The database to connect to. | | **Username**, **Password** | The read-only account. Stored encrypted. | | **Databases (comma-separated; blank for the database above)** | MySQL calls schemas databases. Leave blank to use only the database above. | | **TLS** | **Verify certificate and hostname** (default), **Require TLS**, **No TLS (private development only)**. | | Field | Notes | | - | - | | **Host**, **Port** | Port defaults to `1521`. | | **Service name** or **SID** | Enter exactly one of the two. | | **Username**, **Password** | The read-only user. Stored encrypted. | | **Schemas (comma-separated; blank for the user's own schema)** | Owners whose tables you can register. | | **TLS** | **Verify certificate and hostname** (default), **Oracle native encryption (no certificate; any version)**, **No TLS (private development only)**. | | Field | Notes | | - | - | | **S3 endpoint** | The S3-compatible endpoint URL. | | **Bucket** | The bucket that holds the Parquet files. | | **Object prefix** | Optional folder inside the bucket. | | **Region** | Defaults to `us-east-1`. | | **Access key ID**, **Secret access key** | A key that can read the bucket. Stored encrypted. | Parquet / S3 connections have no SQL alias; their sources use `data.` SQL names. Until you pick a TLS mode yourself, the form suggests one from the host you type. Keep **Verify certificate and hostname** for anything reachable over the internet. ## Choose tables A new connection has no sources yet. Click **Manage tables** on the connection card to open the table picker. DataGen lists the tables the account can see in the configured schemas. Filter by name with **Search tables...** and by **Schema**. Each row shows the SQL name the table will get. Tick tables one by one, or **Select all matching**. You can save up to 100 tables at a time. Click **Save table selection**. Selected tables appear as sources under **Datasets -> Sources** and under the connection's name. Removing a table from the selection removes the source, not any database permission. A source that a published model reads cannot be removed. PostgreSQL, MySQL and Oracle connections can be used by **Native SQL** models without registering any tables. See [Build analytic models](/data/build-models#choose-a-mode). ## Browse the catalog **Datasets** is the workspace catalog. The left side groups it by **All datasets**, **Sources**, **Analytic models** and by connection; the search box matches names and descriptions. Open a source to see: * **Data**: a preview of up to 500 rows, 50 per page, read live from the database. * **Schema**: the columns and their types, a **Data source description**, and a description per column. Descriptions are saved in DataGen and shown to the Data Builder and to agents. The actions menu next to a dataset name has **Copy SQL reference**. ## Keep a connection up to date | Task | How | | - | - | | Detect column changes | **Refresh schemas** on the connection card checks each registered table and reports added, removed and retyped columns. | | Add or remove tables | **Manage tables** again. Existing sources keep their SQL names. | | Change host or credentials | **Edit connection** (pencil icon). Leave credential fields blank to keep the saved credentials. The source type and SQL alias cannot change. | | Delete | **Delete connection** (trash icon) removes the connection and every source imported from it. It is refused while a Native SQL model runs on the connection. | ## How connection credentials are stored Connection credentials (usernames, passwords, access keys) are encrypted and stored with the connection in DataGen. They are not entries in a [Connection Vault](/foundation/vault), they are never returned to the browser, and they are never placed in an agent's sandbox: * The analytics service uses them to read sources when it previews, publishes or refreshes a model. * Agents read published snapshots only, so they need no database credential at all. * The Data Builder agent queries PostgreSQL sources through DataGen's SQL proxy (on deployments that run one), which holds the credentials; other sources are queried by the analytics service on the agent's behalf. The **Vault** chosen in **Data -> Settings** is a different thing: it supplies credentials to the Data Builder agent's own tools, not to connections. ## Next Turn sources into a published, documented model. Revisit the lifecycle, SQL names, roles and limits. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.