# Connect PostgreSQL

Connect a read-only PostgreSQL source over TLS and select the first tables and columns.

## Where to find it

Open **Account > Data Sources**, add a source, and choose PostgreSQL.

Address: `/account/sources/new/postgresql`.

## Choose network and TLS settings

Enter the source and read-only connection fields. **Public endpoint** requires allowing Topline's displayed outbound IPs at the database firewall. **Private network** is a disabled setup-required choice; arrange the approved private path with Topline rather than assuming the wizard provisions it.

Choose **Require TLS** or **Verify certificate and hostname**. The advanced **Custom CA certificate (PEM)** field is for the connection's required CA. Review the access checks, then choose **Save and choose data**. Credentials stay in the secret controls, not chat or SQL notes.

## Select tables and columns

Review discovered schemas and select the intended tables and columns. Every selected sync table requires a primary key; tables without one cannot be selected. Discovery reads their names; it does not copy every row. **Preview 20 rows** performs a bounded sample read, and syncing is a later step. Choose **Save and set schedule** after reviewing the selection.

## Choose the sync mode

| Choice | Behavior |
| --- | --- |
| Incremental by timestamp | Requires a primary key and timestamp; reads new/changed rows. It does not reconcile hard-deleted rows by itself. |
| Full refresh | Requires a primary key, but no timestamp. Re-reads the bounded selected tables and reconciles deleted rows each run. |
| Continuous changes | Disabled advanced setup requiring a private CDC/logical-replication runtime arranged with Topline. |

Review cadence and timezone, then choose **Start first sync**. An incremental configuration needs an appropriate periodic full-refresh plan when hard deletes must be reconciled. A saved connection or selected schema is not a completed initial sync.

## Operate and recover

Open the saved source to inspect readiness, the initial-sync state, and its latest runs. Use the offered first-sync recovery when a sync has not started. **Run full refresh** is a distinct operation from the ordinary incremental cadence. **Rotate credentials or CA** returns to the existing-source connection flow; verify the intended source before saving a replacement.

Resolve network allowlists, TLS/certificate errors, read permissions, or missing key/timestamp requirements before retrying. Setup remains bound to the current account; it does not authorize an external schema migration or deployment.

## Related guides

- [Source details](/docs/source-details)
- [Table details](/docs/table-details)
- [Table syncs](/docs/table-syncs)