Filarr help

External database connectors: create a limited key

For each connector, where to create the key, the smallest scope to give it, where it runs, and what it can do.

On this page
Help sections

A sync with an external database needs a key: give it the smallest possible scope. The key stays in your profile's encrypted keychain (desktop, web), bound to the source's host, or in your gate when the gate runs the sync. Filarr never keeps it.

The connectors

The Feed from an external database… screen offers eight connectors.

connectorthe key, and its smallest scopewhere it runs
D1 (Cloudflare)a custom Cloudflare API token, limited to your account and to D1: read for an import or an incoming mirror, edit to publish or sync both waysdesktop, web, gate
PostgreSQLthe password of a dedicated role (optional if your server accepts a connection without one): SELECT on the tables you need; INSERT, UPDATE, DELETE as well to writedesktop, gate
MySQL (and MariaDB)the password of a user limited to the tables you need, same rightsdesktop, gate
Supabasea project key. The "service" key opens the whole project and bypasses RLS rules: prefer a key bound by limited rulesdesktop, web, gate
Airtablea personal token limited to the base, with data.records:read (and data.records:write to write)desktop, web, gate
Google Sheetsthe JSON file of a service account; share the sheet with that account's address, and nothing else. No Google sign-in window for nowdesktop, web, gate
Notionthe token of an internal integration; invite the integration to the one database to readdesktop, web, gate
CSV or JSON publishedan https address, and if needed an optional keydesktop, web, gate; read only

PostgreSQL and MySQL: the desktop app or a gate

These two connectors open a direct connection to the database. Their drivers ship with the desktop app: nothing to install. A browser cannot open such connections: on the web, they are not offered to run in the app, and their card says "Not from the web". Run the sync from the desktop app, or hand it to a gate, which also reaches a database on your local network.

What each one can do

  • D1, PostgreSQL, MySQL, Supabase write "only if the value has not changed": a value changed in the source during the run is never overwritten.
  • Airtable, Google Sheets, Notion read again just before writing: a window of less than a second remains.
  • Google Sheets is read in full at each run (no change marker).
  • Notion: its API version is pinned by the connector; deleting a row moves the page to Notion's trash. A Notion relation column, or Airtable linked records, cannot be imported yet.
  • CSV or JSON: read only (Once, Incoming mirror).
  • D1, PostgreSQL, MySQL also accept a read-only SQL query (a single SELECT statement), for an import or an incoming mirror.

TLS for PostgreSQL and MySQL

  • verified (default): encrypted, certificate checked against the host name;
  • encrypted, certificate not checked: encrypted, but a machine in the middle could pose as the server;
  • off (local network only): only allowed for a private address or a name ending in .lan, .local, .internal, .home.arpa.

Learn more