Connect your warehouse to Airbrx

Databricks

For Databricks SQL Warehouses, any region, any cloud.

Server hostname

Your workspace hostname, e.g. dbc-1234567890.cloud.databricks.com. The Gateway forwards here when the cache misses. The account console (accounts.cloud.databricks.com) is not it: open a workspace and copy that address instead.

HTTP path (optional)

The path of one SQL Warehouse, e.g. /sql/1.0/warehouses/abc123, from the warehouse's Connection details tab. Set it to pin every query to that warehouse. Leave it empty and each connection keeps choosing its own warehouse, which is usually what you want.

Next, in step 4, your tools keep their own token and warehouse; only the server field changes. Response headers in step 6 work from DBeaver and the Python connector.

Snowflake

For Snowflake, any region, any cloud.

Server hostname

Your account host, e.g. myorg-myaccount.snowflakecomputing.com: the full account identifier, not just the account name. A Snowsight address (app.snowflake.com/myorg/myaccount) is converted for you, with underscores written as hyphens.

That is the whole Snowflake configuration. Warehouse, role and database stay on each tool's connection, where they are today.

PostgreSQL

For PostgreSQL, self-hosted or managed: RDS, Aurora, Azure, Neon, Supabase, Render and the rest. A little more than a hostname, and one real decision.

Host, port, database

Where your database lives, e.g. db.internal.example.com, 5432, analytics. This is where the Gateway forwards, not the address your clients use. A password inside a pasted URL is discarded, never stored.

How do users log in?

The auth mode. Required, with no default. Answer the question below.

Advanced

TLS between the Gateway and your database. It defaults to verify-full, so the Gateway checks your database's certificate. Managed providers need nothing here. With a private CA, paste that CA's certificate as the root certificate. With TLS switched off on the database, turn it on, or lower this as a deliberate choice; the Gateway never downgrades on its own.

Which describes your database?

In every mode the tenant holds no database username or password; there is no field for one. Supported engines describes the modes in full.

What your database has to allow

On a cache miss the Gateway connects to your database, so its firewall or provider network policy has to let the Gateway in. Do not open your database to the whole internet to get there. If you need the addresses to allowlist, ask us.

There is no certificate to create. Your clients connect to a gateway address with a publicly trusted certificate, and the Gateway connects to your database using the certificate it already has.

Check it with psql

Save, then copy the address from the Connect a SQL client card. One login proves the whole path: your client to the Gateway, the auth mode, and the Gateway to your database.

psql "host=your-slug.gateway.airbrx.ai port=5432 dbname=analytics user=analyst sslmode=verify-full sslrootcert=system" -W

TLS is mandatory: sslmode=disable is refused, never downgraded. sslrootcert=system needs libpq 16 or later; with older libpq, point it at your system's CA bundle. require also connects, but does not check whose certificate it got.

How steps 4 to 6 differ

Point a tool

Any PostgreSQL client works: psql, DBeaver, JDBC, SQLAlchemy. Change the host, keep TLS on. The PostgreSQL recipe has the strings.

First rule

A new tenant already has a starter rule caching SELECTs, and one that sends writes to your database and marks cached reads stale. Read them before you query. With row-level security or masking, confirm the cache key includes the user.

Verify

PostgreSQL has no response headers, so a client is never told it got a hit. The tenant's Traffic page shows each statement, its rule, and hit, miss or bypass.

Before you route real data

• Only writes the Gateway sees invalidate the cache. A write straight to your database, from an ETL job, a migration or another application, leaves cached reads serving until their TTL. Set TTLs for the slowest path your data changes by, or invalidate from your pipeline with the markers API.
• COPY passes through, and does not invalidate. A COPY FROM load is never cached, and does not mark cached reads of that table stale. Treat it like a direct write.
• Password changes take up to an hour. A verified credential is remembered for an hour, so a revoked password can keep working that long.
• Cancelling needs a recent client. Cancels are accepted over TLS only: libpq 17 and later can cancel through the Gateway; older libpq and the JDBC driver cannot.

If psql fails