External database access

Your hosted database sits on a private network: your app reaches it, the internet does not. External access gives one outside system (your own backend on another cloud, a BI tool, a migration script) its own credential to reach that database through Meridian’s database gateway at db.the-meridian.app:3306. External access is included with the Pro and Enterprise plans. On Lite, the page offers a plan change instead. If an app moves to Lite, or its plan lapses, its credentials are paused rather than revoked: they stop connecting, live connections close within about a minute, and nothing new can be created or rotated. You can still edit and revoke them. Moving back to Pro or Enterprise makes them work again within about ten minutes, with nothing to reissue.

If the other system only needs your data, expose an HTTPS endpoint on your hosted app and call that instead. Your app keeps control of what is read and written, and the database stays private.

How a credential works

A credential has two parts, and a connection needs both:

A client certificate signed by Meridian’s private certificate authority. Its private key is generated in your browser when you create the credential, and only the public key is sent to Meridian. Meridian never sees or stores the private key.
A MySQL user and password that work on this one database only. The password is shown once and Meridian keeps no copy, only MySQL’s own hash of it.

The gateway admits a connection only when the certificate is the credential’s current one, the user and database are the credential’s own, and the connection comes from an allowed network. Everything else about access is enforced by MySQL grants on that one user.

Limit	Value
Active credentials per database	5
Connections per database	10 at a time, shared by all its credentials
Connections per credential	Its share of those 10, 5 by default
Allowed networks per credential	Up to 20, in CIDR notation
Failed logins before a lockout	10 within 15 minutes, then locked for 15 minutes
Certificate lifetime	One year

Each credential is one of two access modes:

Read-only: SELECT and SHOW VIEW on the database. Right for reporting, BI tools and anything that only reads.
Read-write: everything your app itself can do on the database, including changing and deleting data and tables. Give it only to a system you trust.

External access is for MySQL databases that are ready. If the External access page says it is not available, the database is still provisioning, or external access is not yet switched on for the platform.

Creating a credential

Open Hosting → Database → External access and select New credential.
Give it a label named after the system that connects (aws-backend, metabase). Letters, digits, spaces, _, . and -, up to 64 characters.
Pick Read-only or Read-write.
Optionally list allowed networks, one per line, such as your backend’s NAT egress address as 203.0.113.7/32. Leave it empty to allow any network.
Set Connections: how many connections this credential may open at once. A database’s credentials share 10 connections between them, and the field shows how many are free. It starts at 5, or at what is left if that is less.
Select Create credential. Your browser generates the key pair, sends the public key, and receives the certificate and password.

The next screen shows the host, port, database, user, password and DATABASE_URL once. Select Download bundle to save a ZIP with:

File	What it is
`client.pem`	Your client certificate
`client.key`	The certificate’s private key, generated in your browser
`ca.pem`	Meridian’s certificate authority. Trust it for the gateway’s server certificate
`.env`	`DATABASE_URL`, its parts (`DATABASE_HOST`, `DATABASE_PORT`, `DATABASE_NAME`, `DATABASE_USER`, `DATABASE_PASSWORD`) and the paths of the three files above
`README.txt`	Setup for the `mysql` CLI, Node, Prisma and Python

The screen cannot be closed until you confirm you saved the bundle. The private key exists only in that bundle: close the screen without it and the credential cannot connect, so rotate it to get a new one. Store the files the way you store other production secrets (AWS Secrets Manager, Google Secret Manager, Vault, or your platform’s equivalent).

Connecting

Every connection uses TLS 1.2 or later with the client certificate, and verifies the gateway’s server certificate against ca.pem for the name db.the-meridian.app. Connect by that name, not by IP address, or the server name check fails.

Prisma

Prisma reads the client certificate and key from one PKCS#12 file. Create it once, choosing its password:

openssl pkcs12 -export -in client.pem -inkey client.key -out client.p12

Use OpenSSL 3 with its defaults. A file exported with -legacy cannot be read by Prisma 6. Then set DATABASE_URL with the TLS parameters. sslcert is the CA that verifies the server, sslidentity is your client identity, and both paths are relative to the folder of schema.prisma:

DATABASE_URL="mysql://<user>:<password>@db.the-meridian.app:3306/<database>?sslaccept=strict&sslcert=ca.pem&sslidentity=client.p12&sslpassword=<p12 password>"

Node.js (mysql2)

import fs from "node:fs"
import mysql from "mysql2/promise"

const pool = mysql.createPool({
  uri: process.env.DATABASE_URL,
  connectionLimit: 5,
  ssl: {
    ca: fs.readFileSync("ca.pem"),
    cert: fs.readFileSync("client.pem"),
    key: fs.readFileSync("client.key"),
    minVersion: "TLSv1.2",
    // mysql2 checks the server name only when asked.
    verifyIdentity: true,
  },
})

Keep the pool at or below the credential’s connections (5 unless you changed it).

Go (go-sql-driver/mysql)

import (
	"crypto/tls"
	"crypto/x509"
	"database/sql"
	"os"

	"github.com/go-sql-driver/mysql"
)

func open() (*sql.DB, error) {
	ca, err := os.ReadFile("ca.pem")
	if err != nil {
		return nil, err
	}
	roots := x509.NewCertPool()
	roots.AppendCertsFromPEM(ca)

	cert, err := tls.LoadX509KeyPair("client.pem", "client.key")
	if err != nil {
		return nil, err
	}

	if err := mysql.RegisterTLSConfig("meridian", &tls.Config{
		RootCAs:      roots,
		Certificates: []tls.Certificate{cert},
		ServerName:   "db.the-meridian.app",
		MinVersion:   tls.VersionTLS12,
	}); err != nil {
		return nil, err
	}

	db, err := sql.Open("mysql", os.Getenv("DATABASE_USER")+":"+os.Getenv("DATABASE_PASSWORD")+
		"@tcp(db.the-meridian.app:3306)/"+os.Getenv("DATABASE_NAME")+"?tls=meridian")
	if err != nil {
		return nil, err
	}
	db.SetMaxOpenConns(5)
	return db, nil
}

Python (PyMySQL)

import os
import pymysql

connection = pymysql.connect(
    host="db.the-meridian.app",
    port=3306,
    user=os.environ["DATABASE_USER"],
    password=os.environ["DATABASE_PASSWORD"],
    database=os.environ["DATABASE_NAME"],
    ssl_ca="ca.pem",
    ssl_cert="client.pem",
    ssl_key="client.key",
    ssl_verify_cert=True,
    ssl_verify_identity=True,
)

Java (JDBC)

MySQL Connector/J reads the client identity and the CA from key stores. Create both once:

openssl pkcs12 -export -in client.pem -inkey client.key -out client.p12 -passout pass:<p12 password>
keytool -importcert -noprompt -alias meridian-ca -file ca.pem \
  -keystore truststore.p12 -storetype PKCS12 -storepass <truststore password>

Then connect with sslMode=VERIFY_IDENTITY:

jdbc:mysql://db.the-meridian.app:3306/<database>?sslMode=VERIFY_IDENTITY
  &clientCertificateKeyStoreUrl=file:client.p12
  &clientCertificateKeyStoreType=PKCS12
  &clientCertificateKeyStorePassword=<p12 password>
  &trustCertificateKeyStoreUrl=file:truststore.p12
  &trustCertificateKeyStoreType=PKCS12
  &trustCertificateKeyStorePassword=<truststore password>

The URL is one line, wrapped here to read. Pass the user and password as the connection’s user and password properties.

Laravel (PDO)

Point the mysql connection in config/database.php at the three files. Use absolute paths, since PHP resolves relative ones from the working directory:

'mysql' => [
    'driver' => 'mysql',
    'host' => env('DB_HOST', 'db.the-meridian.app'),
    'port' => env('DB_PORT', '3306'),
    'database' => env('DB_DATABASE'),
    'username' => env('DB_USERNAME'),
    'password' => env('DB_PASSWORD'),
    // ...
    'options' => extension_loaded('pdo_mysql') ? array_filter([
        PDO::MYSQL_ATTR_SSL_CA => env('DATABASE_SSL_CA'),
        PDO::MYSQL_ATTR_SSL_CERT => env('DATABASE_SSL_CERT'),
        PDO::MYSQL_ATTR_SSL_KEY => env('DATABASE_SSL_KEY'),
        PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT => true,
    ]) : [],
],

mysql CLI

mysql --host=db.the-meridian.app --port=3306 --user=<user> --password \
  --ssl-mode=VERIFY_IDENTITY --ssl-ca=ca.pem --ssl-cert=client.pem --ssl-key=client.key \
  <database>

--ssl-mode is the MySQL client’s option. The MariaDB client uses --ssl-verify-server-cert with the same three file options.

Managing credentials

The External access page lists every credential with its label, MySQL user, access mode, status, when and from which address it last connected, when its certificate expires, and who created it. A credential’s status is one of:

Active: it can connect.
Locked: it had 10 failed logins within 15 minutes. New connections are refused, while connections already open keep running. It unlocks by itself after 15 minutes, and rotating unlocks it at once. Everyone with access to the app gets a notification when a credential locks.
Expired: its certificate is past its one-year lifetime. Rotate it to issue a new one.
Revoked: it no longer works, and is kept in the list for the record.

From a credential’s menu:

Edit changes the label, the allowed networks and the credential’s connections. New connections see the change within 30 seconds. Lowering the connections leaves connections already open running; new ones are refused until the count drops under the new limit.
Rotate issues a new certificate and a new password, with a new private key generated in your browser, and shows them once, like a new credential. The old certificate and password stop working at once, and connections opened with them are closed, so update the system that uses them straight away. Rotate before the certificate expires, and whenever a file of the bundle may have leaked.
Revoke deletes the credential’s MySQL user. Connections using it stop within 30 seconds. This cannot be undone: create a new credential if the system needs access again.

Deleting the database revokes all of its credentials.

Recent connections and usage

The history button on a credential’s row shows its last 100 connections and failed logins from the past 30 days: when, from which address, how long each connection lasted and how much it sent to your backend. Anyone who can see the app’s hosting can open it. What the database sends to your backend through the gateway counts towards the app’s monthly outbound bandwidth, like any other response your app serves.

Who can do it

Action	Permission
See the list of credentials	Hosting: View
Create, edit, rotate and revoke credentials	Credentials: Manage (`credentials.manage`)

No role can read a password or private key back after the one-time screen. Creating, editing, rotating and revoking a credential are each recorded in the organization audit log. See Customer permissions and Roles.

Troubleshooting

Access denied: “This client certificate is not a current Meridian credential”. The certificate was rotated or revoked, it has expired, or the app’s plan no longer includes external access. Check the credential’s status and the app’s plan. The connection closes during or right after the TLS handshake. The gateway did not accept the certificate. It was rotated, revoked or has expired, or the client is presenting a different certificate than the one in this credential’s bundle. Check the credential’s status, and rotate it to get a fresh bundle if the files are lost or out of date. Check too that the client verifies against ca.pem and connects to db.the-meridian.app by name. Access denied when logging in. The password is wrong, or the credential is locked after 10 failed logins. A locked credential shows Locked on the page: wait 15 minutes, or rotate it to unlock it at once with a new password. Check that the user and database are the credential’s own, exactly as in .env. A different database name is refused. The connection is refused from one machine and works from another. The source address is not in the credential’s allowed networks. The address the gateway sees is your network’s public egress address (a NAT gateway or load balancer), not the machine’s private IP. The page shows the last address that connected. Add the right network with Edit. USE otherdb or a query on another database is refused. A credential reaches its own database only. Switching to another database at the protocol level closes the connection (error 1047), and a query that names another database is refused by MySQL. USE of your own database works, so drivers that select the database again on reconnect are fine. Connect with the database name from .env. Too many connections. A credential allows only its share of the database’s 10 connections, 5 by default. Cap your connection pool at that number, or move connections to it from another credential with Edit.

Concepts

Organization

Apps

Pricing plan builder

Usage

CRM

Automations

Emails

Affiliates

Hosting

AI Assistant

App Store

Access and sign-in

External database access

How a credential works

Creating a credential

Connecting

Prisma

Node.js (mysql2)

Go (go-sql-driver/mysql)

Python (PyMySQL)

Java (JDBC)

Laravel (PDO)

mysql CLI

Managing credentials

Recent connections and usage

Who can do it

Troubleshooting

​How a credential works

​Creating a credential

​Connecting

​Prisma

​Node.js (mysql2)

​Go (go-sql-driver/mysql)

​Python (PyMySQL)

​Java (JDBC)

​Laravel (PDO)

​mysql CLI

​Managing credentials

​Recent connections and usage

​Who can do it

​Troubleshooting

How a credential works

Creating a credential

Connecting

Prisma

Node.js (mysql2)

Go (go-sql-driver/mysql)

Python (PyMySQL)

Java (JDBC)

Laravel (PDO)

mysql CLI

Managing credentials

Recent connections and usage

Who can do it

Troubleshooting