Supported Databases

Connecting to your database from Beekeeper Studio is easy. You can connect to a database in a few different ways:

1. For SQLite databases, you can simply double click the file in your file browser
2. For other databases, you can specify host & port, or the unix socket path.
3. Some cloud vendors support connecting with custom authentication methods, Beekeeper Studio supports many of these too (eg: SSO for Azure SQL).

First Step: Select Connection Type

When you open Beekeeper Studio for the first time, you'll see the connection screen. You can select the type of connection you want to make from the dropdown.

You can also import a database URL here, this is super useful for Heroku Postgres, Azure SQL, and other cloud databases.

Optional: Explore The Demo Database

Every new Beekeeper Studio installation comes with a Demo Database in the right side menu. This is a small SQLite database we bundle with the app. You can use this to explore Beekeeper Studio's features without connecting to a real database.

Complete

The Beekeeper Studio Connection Screen

Connection Mode

You can connect to some databases with either a socket or a TCP connection. Socket connections only work when the database server is running on your local machine (it's the default set-up for a MySQL installation for example). TCP connections require a hostname and port.

TCP (Host/Port) connection example

Note that SSL, SSH, and other advanced connection options are only available with a TCP connection.

SSL

Beekeeper Studio's SSL Configuration

There are three ways to connect to a database with SSL

1. Trust the server: Connect with SSL without providing your own certificate. This is the default.
2. Required Cert: Connect with SSL, provide your own certs, and disable rejectUnauthorized.
3. Verified Cert: Connect with SSL, provide your own certs, and enable rejectUnauthorized.

Here's a table of how the various sslmode flags from command line clients map to Beekeeper:

You can provide your own custom certificate files if needed.

SSH

Beekeeper Studio's SSH configuration

Server Configuration

Before you can use an SSH tunnel to connect to your database, you need to make sure your SSH server is setup correctly.

Firstly make sure the following line is set in your /etc/ssh/sshd_config:

AllowTcpForwarding yes

ssh-rsa public keys

If you are using an ssh key generated by the ssh-rsa algorithm, you'll need to enable support for this algorithm in your ssh server.

To do this, you can add the following line to the /etc/ssh/sshd_config file on your SSH server

PubkeyAcceptedKeyTypes +ssh-rsa

Yes, the + is intentional {: .text-muted .small .text-center }

Client Configuration Options

Beekeeper supports tunneling your connection via SSH. To connect to a remote database using your SSH account on that machine:

1. Activate the SSH Tunnel to reveal the ssh connection detail fields

2. Enter the SSH Hostname or IP address of the remote SSH server

3. Change the SSH server's Port if it doesn't accept connections on the default port 22

4. Enter Bastion Host (JumpHost) (optional) if your server's network requires that you connect through a JumpHost

5. Enter the Keepalive Interval (optional) to specify, in seconds, how often to ping the server while idle to prevent getting disconnected due to a timeout. This is equivalent to the ServerAliveInterval option you might use on the ssh command line, or in your ~/.ssh/config file -- Entering 0 (zero) disables this feature

6. Select your SSH Authentication method:

   • Automatic (default) — Beekeeper picks the right key for you, in the same order ssh itself does. See below.

   • Key File — pick a specific SSH Private key File (and optionally enter the Key File PassPhrase). Use this when you want to override Automatic and authenticate with one specific key.

   • Username and Password — enter both your SSH Username and SSH Password.

7. Enter a name for your Connection (optionally check the Save Passwords checkbox) and Press Save to have Beekeeper remember all of the above for you

8. Press the Connect button to access your database!

Automatic authentication (default)

In Automatic mode, Beekeeper tries the same things ssh does, in this order, and uses the first one that works:

1. SSH agent. Whatever your SSH_AUTH_SOCK (or PuTTY's pageant on Windows) is advertising.
2. IdentityFile from ~/.ssh/config. Used if the matching Host entry has one. Honors IdentitiesOnly yes — when set, the agent is restricted to keys whose public part matches an IdentityFile.
3. Default key. The first of ~/.ssh/id_ed25519, ~/.ssh/id_ecdsa, ~/.ssh/id_rsa, or ~/.ssh/id_dsa that exists.

When you select Automatic in the form, a small status row appears under the dropdown: SSH agent › SSH config › Default key. Each pill shows a check or x and reveals the discovered path on hover, so you can see at a glance which step will satisfy the connection.

If you'd rather skip Automatic and pick a key explicitly, choose Key File and select the key yourself.

Other authentication methods

• Key File — uses the SSH Private key File you select (and optional Key File PassPhrase). Beekeeper does not fall back to IdentityFile from ~/.ssh/config in this mode — picking Key File means you want this specific key. Hostname/port/user from ~/.ssh/config aliases still apply.
• Username & Password — uses the form's SSH Username and SSH Password. Hostname/port/user from ~/.ssh/config aliases still apply; no key files are tried.

Bastion (jump) host

The Bastion section repeats the same three authentication modes (Automatic, Key File, Username & Password) with the same behaviour. The bastion is visually nested under the SSH section to make it clear that the bastion's credentials connect to the bastion, while the outer SSH fields connect to the target through it.

Using ~/.ssh/config

You can type a Host alias from your ~/.ssh/config into the SSH Hostname or Bastion Host field. Beekeeper resolves the following keys from the matching Host and Match entries, regardless of which authentication mode you picked:

Multiple IdentityFile entries are allowed. Beekeeper tries them in order and, like ssh, skips any whose file doesn't exist instead of failing the connection.

For example, given this entry:

Host production
  HostName db.internal.example.com
  Port 22022
  User admin
  IdentityFile ~/.ssh/prod_ed25519
  IdentitiesOnly yes

Type production into the SSH Hostname field, leave the other fields blank, pick Automatic as the auth method, and Beekeeper will fill in the rest — connecting to db.internal.example.com:22022 as admin, restricted to the agent identity that matches prod_ed25519.

When you also enter a value in the form, the form value wins — ~/.ssh/config only fills in the fields you leave blank. The hostname itself is the one exception: an alias is always resolved to its real HostName so the connection can be made.

Match blocks

Match blocks are evaluated, and any of the resolved keys above that they set are applied. The supported match criteria are:

Match exec and config file permissions

Match exec runs an arbitrary command, exactly as ssh does. To avoid running commands from a config you don't control, Beekeeper mirrors OpenSSH's safeguard: your ~/.ssh/config is only read when it is owned by you (or root) and not writable by group or other users (e.g. chmod 600). A config with looser permissions is ignored entirely and a warning is logged. This check is POSIX-only; on Windows the file is always read. Note that Match exec is evaluated through your system shell, so its availability depends on the platform.

Include

Include support is partial. Included files are read in place, and glob patterns work:

Include ~/.ssh/config.d/*.conf
Include work/bastion.conf

Paths can be absolute, start with ~, or be relative to the folder holding the config file. Included files must meet the same permission requirements as ~/.ssh/config.

Two limits: an Include must start at the beginning of a line, so an indented one inside a Host block is ignored, and an Include inside an already-included file is skipped.

Supported and unsupported ssh_config features

Supported

• Host aliases and Match blocks (all, host, originalhost, user, localuser, final, exec)
• HostName, Port, User
• IdentityFile (one or more; Automatic mode), with missing files skipped
• IdentitiesOnly
• Glob patterns and negation (!) in Host / Match host patterns
• Include, at the start of a line, including glob patterns

Not supported (ignored)

• ProxyJump / ProxyCommand — configure the bastion host explicitly in the connection form instead
• ForwardAgent, LocalForward, RemoteForward, DynamicForward
• Indented Include directives, and Includes inside an already-included file
• Any other directive not listed under Supported above

If you rely on ProxyJump, configure the bastion host explicitly in the connection form.

File Associations

Beekeeper Studio provides file associations so you can do the following things without opening the app:

• Double click a sqlite .db file in a file browser to open it in Beekeeper Studio!
• Open URLs and files from the terminal:
  • Mac: open postgresql://user@host/database or open ./example.db
  • Linux: xdg-open postgresql://user@host/database or xdg-open ./example.db