Overview
The other strings Supabase shows you change the host, port, and username — and each change means a completely different path to your database.
Connection strings
Here’s what they are — and when to use each one.
No pooler. One backend per connection. Requires IPv6 (or IPv4 add-on). Best for long-lived servers with a stable pool.
Same host as direct. Transaction mode. IPv6 or add-on. Battle-tested PgBouncer.
Regional pooler host, routed user. IPv4-friendly. Ideal for serverless and short-lived connections.
Session-scoped like direct, via pooler. IPv4-friendly. Alternative to direct on IPv4 networks.
Interactive explorer
1 2 main tabs · ← → step · Shift+←→ slides
Example URIs for project ref cqesudmnzjvyhffjvipn — Prev/Next highlights the same step in all four rows at once
Choosing a connection
6543 (Supavisor or PgBouncer).5432.5432 on the pooler = session; 6543 = transaction (Supavisor or PgBouncer).Security
By default, Supabase allows connections without SSL for compatibility — you can enforce SSL in database settings. Postgres has six sslmode values; mode matters for security.
| Mode | What it means |
|---|---|
disable |
No encryption, no negotiation. |
allow |
No preference; encrypts if the server demands it. |
prefer |
Tries SSL but can fall back to plaintext — many clients’ default; you might think you’re encrypted when you aren’t. |
require |
Encrypts the connection; doesn’t verify the server certificate. Good default for most Supabase apps — encryption without managing a CA bundle. |
verify-ca |
Encrypts and checks the cert was signed by a trusted CA. |
verify-full |
Encrypts, verifies CA, and checks hostname matches the certificate — strongest mode; aligns well when SSL enforcement is on. |
Tip: Don’t leave clients on prefer if you care about knowing you’re encrypted — use require or stronger.
Summary
The connection string is routing in one line: host and port decide direct vs pooler and which mode; SSL settings decide how the channel is protected; the role you use decides what the session can do.
Next: IPv4 add-on and checking your project’s IP — then roles and least privilege in production.