Custom PostgreSQL LOGIN roles for external Retool Database access on Free plan

💬 Queries and Resources
1

Hi Retool Community,

I'm developing a small restaurant staff portal using Next.js and Clerk, with an existing Retool Database (PostgreSQL) as the backend.

For security, I want the external application to connect using a dedicated, restricted PostgreSQL login instead of the default high-privilege retool account.

I've confirmed through read-only PostgreSQL queries that the current database role has CREATEROLE permission, and that the relevant tables are owned by retool.

Before making any database changes, could someone please clarify:

  1. Does Retool Database support external PostgreSQL connections using a custom LOGIN role created via CREATE ROLE, with its own password?

  2. Is this supported on the Retool Free plan, including after downgrading from a paid plan?

  3. Can the custom role be restricted to specific tables and SQL operations without inheriting the default retool account's privileges?

  4. Are there any managed-database restrictions, connection-pool limitations, or role-management issues that would make this approach unsupported or unreliable?

My goal is to use a least-privilege database connection from a server-side Next.js API. I do not intend to expose any database credentials to the browser.

I'd appreciate confirmation from someone familiar with Retool Database's managed PostgreSQL configuration.

Thank you!

2

Summary

Developing a Next.js restaurant portal backed by an existing Retool Database (managed PostgreSQL) and wants to connect server-side using a dedicated, least-privilege PostgreSQL LOGIN role (via CREATE ROLE, scoped to specific tables/operations) instead of the default retool account — asking whether this is supported for external access, including on a free/downgraded plan.

AI Response

Yes — cloud-hosted organizations can access Retool Database externally via the provided PSQL command or PostgreSQL connection URL (admin-only to view). Using that connection in psql or a GUI like pgAdmin, you can create a dedicated LOGIN role with its own password and scope it with GRANT/REVOKE to specific tables and SQL operations, which is exactly the least-privilege pattern for a server-side API. Note that the native RetoolDB is a managed database, so superuser-level operations are not available and role management is limited to standard PostgreSQL privileges; the published docs indicate external access is available across plans for cloud orgs, but the Retool Database editor may not immediately reflect objects created via the external connection.

Sources

:bookmark: Can I restrict retool database external connection permissions
A solved thread showing exactly how to connect to RetoolDB with psql/pgAdmin, create a dedicated restricted user, and apply GRANT/REVOKE statements for a least-privilege (e.g., read-only) external connection.
:bookmark: Access Retool Database tables externally | Retool Docs
Official docs confirming cloud-hosted orgs can access Retool Database externally via PSQL command or PostgreSQL connection URL, including using role names and passwords in external applications/ORMs.

The Community Team is testing out a new automation. Let us know if it's helpful (or not) by leaving a :heart:, :+1:, or :-1:. Or by marking this post as the "Solution"! Let us know if you have any feedback here. :rocket: