Version: v2.x

Postgres & Compatible Databases

Introduction

Hasura enables connecting to a Postgres and Postgres compatible databases to automatically build an rich GraphQL API based on the schema.

Supported Postgres versions

Hasura GraphQL Engine supports all supported versions of Postgres per the public documentation.

Postgres compatible

Hasura supports most databases with full Postgres compatibility such as:

Postgres

Aiven

AlloyDB

AWS RDS Aurora Postgres

AWS RDS Postgres

Azure Cosmos

Azure Postgres

Crunchy Postgres

Digital Ocean Postgres

ElephantSQL

EnterpriseDB

Google Cloud SQL Postgres

Neon Postgres

Railway Postgres

Render Postgres

Supabase Postgres

TimescaleDB

YugabyteDB

Managing data with the Hasura Console

The Hasura Console is a web UI that allows you to manage your data and metadata. It is available at http://localhost:8080/console when you run Hasura locally, or from your project's Console endpoint when you use Hasura Cloud.

The data-management features (such as creating tables) are available in the Data tab. You can access your GraphQL API in the API tab and interact with it using the GraphiQL interface.

Console support

You can use these tools to manage your PostgreSQL database, but we recommend using your preferred PostgreSQL client instead. The Hasura Console is designed to be a tool for managing your GraphQL API, and not a full-fledged database management tool.

Required user role permissions

Below are the role permissions required for Hasura to perform all its functionality. Note that, with the exception of CONNECT and GRANT USAGE, the other features are opt-in, and not enabling them will simply mean that only the corresponding Hasura features will not work.

CONNECT is required in order for Hasura to connect to your Postgres data source.
You must GRANT USAGE to the Hasura user role for any schema you want to access via Hasura.
To allow queries and subscriptions via the GraphQL API, SELECT permissions are required.
Similarly, INSERT, UPDATE, and DELETE permissions are required for mutations.
The Hasura Console requires permissions such as REFERENCES and CREATE to make changes to your schema.
TRIGGER is required to use Event Triggers
If you want to use computed fields or user-defined Postgres functions, the EXECUTE permission is required.

Connecting to Postgres with SSL Authentication

Hasura supports SSL-based authentication for connecting to a PostgreSQL database without requiring password authentication. Below are the steps to configure SSL authentication correctly:

Step 1. Configure SSL Certificates

Ensure that the required SSL certificates are available and correctly mounted in the Hasura container or pod.

SSL_ROOT_CERT: Path to the root CA certificate (e.g., /shared-fs/ssl-db/rootCA.crt)
SSL_CERT: Path to the client certificate (e.g., /shared-fs/ssl-db/client.crt)
SSL_KEY: Path to the client private key (e.g., /shared-fs/ssl-db/client.pem)

Important

Ensure the private key is in .pem format and has the correct permissions:

chmod 0600 /shared-fs/ssl-db/client.pem

Step 2. Set the Connection String

Use the following format for the HASURA_GRAPHQL_DATABASE_URL environment variable:

HASURA_GRAPHQL_DATABASE_URL="postgresql://<user>@<host>:<port>/<database>?sslmode=verify-ca&sslcert=/path/to/client.crt&sslkey=/path/to/client.pem&sslrootcert=/path/to/rootCA.crt"

Step 3. Verify Connection

Test connectivity using psql from inside the Hasura container:

psql "postgresql://<user>@<host>:<port>/<database>?sslmode=verify-ca&sslcert=/path/to/client.crt&sslkey=/path/to/client.pem&sslrootcert=/path/to/rootCA.crt"

If successful, Hasura should now be able to connect using SSL authentication.

Troubleshooting

If the connection fails, check for:

Incorrect file permissions (0600 is required for the private key).
A mismatched private key format (use .pem instead of .pk8).
Logs in the Hasura container (docker logs <container_id> or kubectl logs <pod_name>).
PostgreSQL server logs for authentication failures.

Know more

Note

If you're interested in learning more about PostgreSQL, check out this tutorial from our Learn site.