Connect

Read this the first time you add a database, or when a connection opened read-only and you want to know why. Every connection goes through the same two-step dialog, and every one opens locked unless you say otherwise.

Reach the server

1. Press ⇧⌘N on macOS or Ctrl+Shift+N on Windows. The dialog opens as Connect a database.
2. Pick the engine. Alt+1 to Alt+4 choose PostgreSQL, MySQL, MariaDB and SQLite, in that order.
3. Give it the address. Paste a URL such as postgresql://app@db.internal:5432/commerce into Connection URL, or fill in Host, Port, Username, Password and Database.
4. Click the TLS chip under the fields if this server needs another mode.
5. Click Connect. The button reads Connecting… while it works.

A URL already on your clipboard shows up as Connection URL on your clipboard, with Use it. A password inside the URL moves to the Password field and is never kept in the URL. SQLite asks for a Database file instead and stores only its path. Database is marked Required on every engine except PostgreSQL.

There's no test button. Connect is the test, and a failure keeps you on this step. A wrong field is marked with Seqora couldn’t connect.. Anything else says what went wrong and names the engine, such as "PostgreSQL rejected the credentials for “app”. Check the username and password.", and a slow or TLS failure offers a one-click Retry with a 30s timeout or Retry without certificate verification.

Other ways in

• Import connections…, at the bottom of this step and in the command palette, reads .pgpass, pg_service.conf, a MySQL option file, a .env file, and the saved connections of DBeaver, DataGrip and TablePlus. Nothing is uploaded. Those tools' encrypted passwords aren't read, so an imported connection asks for its password the first time you connect. Imported connections start offline and locked.
• A seqora://connect?url=… link opens this dialog with the URL filled in and the banner From a link. Check it before you connect.. Only PostgreSQL, MySQL and MariaDB URLs are accepted.
• A .sqlite file double-clicked in the OS, dropped on the window, or opened with ⌘O or Ctrl+O opens on its saved connection, or lands here already tested and waiting for a name.

TLS modes

Use Verify for anything on the public internet. Require encrypts but doesn't check who answered.

Through a bastion

1. Click the No SSH tunnel chip.
2. Turn on Connect through an SSH tunnel.
3. Pick a host listed under From ~/.ssh/config, or fill in SSH host, Port and SSH username.
4. Choose how to sign in. Private key takes a key file such as ~/.ssh/id_ed25519 and an optional Passphrase. Password takes an SSH password. SSH agent uses the keys your agent already holds: ssh-agent, Pageant or 1Password.
5. Click Connect. The first time you reach a server, the panel stops at Trust this SSH server? with the host's fingerprint. Check it against the one the server's administrator gave you, then click Trust and connect.

The chip now reads SSH via bastion.internal. A passphrase or SSH password is stored encrypted on this device, next to the database password. If the server's key changes later, Seqora refuses to connect and offers Forget the saved host key, which you should click only when you know why the key changed.

The third chip sets Connection timeout in seconds, 10 unless you changed the setting of the same name.

Name it and place it

After Connect succeeds the dialog shows Connected · PostgreSQL and the server version.

1. Type a Name, for example commerce-primary.
2. Choose the Database from the list the server reported.
3. Choose or type a Workspace. A new one asks for a New workspace color.
4. Choose or type an Environment, such as dev, staging or prod.
5. Leave Open read-only on unless you are about to write.
6. Click Save connection.

The connection appears in the sidebar under its workspace and environment, with a lock beside it.

Where the password goes

Seqora keeps connection profiles and passwords in a SQLite database on your computer, encrypted with SQLCipher. The key to that database lives in Windows Credential Manager on Windows and your login keychain on macOS. Nothing goes into a config file. If the keychain refuses to hand over the key, Seqora shows Seqora could not unlock your workspace instead of opening the store.

Why it opens locked

Lock writes by default, in Settings › Connections and Safety, is on from install. So every new connection starts with Open read-only on, its lock reads Locked · read-only, and the status bar shows Read-only.

A locked connection refuses anything Seqora cannot prove is a read, with "This connection is locked and only read-only SQL can run." It also disables Begin and Commit, stops table edits with "Unlock the connection to change rows.", and blocks applying a schema design.

To unlock:

1. Click the lock beside the connection in the sidebar, or the Locked · read-only button in an editor's header.
2. Click Unlock connection in the Unlock connection? dialog. Keep locked or Esc backs out.

The lock now reads Unlocked · writes enabled. To lock it again, click the same lock, or run Lock writes on commerce-primary from the command palette.

What naming an environment prod changes

There is no production checkbox. An environment with prod or production as one of its words, such as prod-eu, EU Prod or prod2, changes three things:

• Open read-only is on even if Lock writes by default is off, with the note "On by default for production. Unlock from the sidebar when you need to write."
• Review staged changes shows a Production badge, its apply button turns red, and it needs ⌘↩ or Ctrl+Enter rather than a bare Enter.
• Applying a schema design asks you to type the database name: "This is a production connection. Type commerce to apply."

An environment called live gets none of this, and neither do pre-prod, non-prod or preprod, because the word before prod says they aren't. Name it for what it is. The same rule decides which imported connections open locked and when Analyze asks before a write.

Caveats

• The lock is Seqora's, not the server's. For a guarantee, connect as a database user that only has SELECT.
• SQLite connections are a file path. There is no TLS or SSH tunnel to set.
• Seqora speaks SSH itself rather than running your system ssh. It reads ~/.ssh/config for each host's HostName, Port, User and IdentityFile, and known_hosts for keys it has already seen. Other options in the config, such as ProxyJump, are not followed.
• Changing Lock writes by default affects connections you add afterwards. Existing ones keep their lock state.