PostgreSQL Accounts - Infisical

PostgreSQL accounts let you manage access to your PostgreSQL databases. Users connect through Web Access (a browser-based interface) or CLI (a local proxy), and every session can be recorded.

Creating an Account

<Steps> <Step title="Start adding an account"> Go to **Privileged Access Management → Accounts** and click **Add Account**. </Step> <Step title="Select a folder and template"> Choose which [folder](/documentation/platform/pam/folders/overview) to add the account to, then select a PostgreSQL [template](/documentation/platform/pam/templates/overview) (e.g., the default `postgres` or a custom one). </Step> <Step title="Enter connection details"> | Field | Description | |-------|-------------| | **Name** | A descriptive name (e.g., `orders-db-readonly`) | | **Host** | Database hostname or IP | | **Port** | PostgreSQL port (default: 5432) | | **Database** | Database name | | **SSL Enabled** | Enable SSL for the connection | | **Reject Unauthorized** | Reject connections with invalid certificates (only if SSL enabled) | | **SSL Certificate** | Custom CA certificate (only if SSL enabled) | </Step> <Step title="Enter credentials"> | Field | Description | |-------|-------------| | **Username** | PostgreSQL username | | **Password** | PostgreSQL password | </Step> <Step title="Save"> Click **Create**. </Step> </Steps>

Connecting

<Tabs> <Tab title="Web Access"> Web Access provides a browser-based interface with two tools:

- **Data Explorer** — browse tables, view data, filter and sort, edit rows, export to CSV/JSON
- **SQL Editor** — write and run SQL queries, use transactions

To connect:
1. Go to **Privileged Access Management → My Access**
2. Find the account and click **Launch → Connect in Browser**

</Tab> <Tab title="CLI"> The CLI starts a local proxy that you connect to with your preferred PostgreSQL client.

```bash
infisical pam access backend-team/orders-db
```

The command outputs the local port to connect to. Then use your PostgreSQL client:
```bash
psql "postgresql://localhost:<port>/orders"
```

No password needed since the proxy handles authentication.

**Flags:**
- `--port <port>` — use a specific local port (otherwise one is assigned automatically)
- `--reason <reason>` — provide an access reason (if required by template)

</Tab> </Tabs>

Next Steps

<CardGroup cols={2}> <Card title="SSH Accounts" icon="terminal" href="/documentation/platform/pam/accounts/ssh"> Add SSH server accounts. </Card> <Card title="Sessions" icon="display" href="/documentation/platform/pam/sessions/overview"> View and manage sessions. </Card> </CardGroup>