Retool_

An Appwrite native MySQL database exposes a standard MySQL connection, so Retool connects to it through the built-in MySQL resource. Use the database hostname and credentials from Appwrite, then build queries, tables, and forms in Retool for dashboards and admin panels.

Choose credentials

The username is admin.<hash>, and the database name is default. The connection string has this form: mysql://admin.<hash>:<password>@db-<hash>.<region>.appwrite.center:3306/default?ssl=true.

Use the returned admin.<hash> credentials for the Retool resource and keep access limited through Retool resource permissions, Appwrite network controls, TLS, and narrowly scoped queries. Retool stores resource credentials server-side, so app users query through the Retool resource instead of connecting to MySQL from the browser.

Create the MySQL resource

In Retool, go to Resources, click Create new > Resource, search for MySQL, and select the MySQL tile. Give the resource a clear Name and optional Description that identifies the Appwrite database and environment.

In Resource credentials, either paste the Appwrite connection string or fill in the fields manually:

In Advanced options, choose an outbound region if your Retool organization uses regional egress and you want the resource traffic to originate near your Appwrite database.

Enable SSL/TLS. Appwrite Cloud terminates TLS at the edge, and the certificate is signed by a public CA. If Retool shows Reject unauthorized, keep it enabled. If Retool shows Verification mode, choose Full verification. Leave CA certificate empty.

Click Test connection. If the test succeeds, click Create resource.

Pick the connection path

For most Retool apps, connect directly to MySQL on port 3306. Appwrite's MySQL connection pooler listens on port 6033. If your Retool queries rely on session-level state such as server-side prepared statements, user variables, or temporary tables, set the pooler to session mode. The mode applies to every client of the database, not only Retool.

Allow Retool Cloud through the network

If you enabled an IP allowlist for the database, add the Retool Cloud egress addresses for the resource's outbound region. Retool's default outbound region is us-west-2, and Retool also documents eu-central-1 and ap-southeast-1 egress addresses. Retrieve the current list from Retool's IP address documentation instead of copying static addresses into your runbook.

If you leave the database allowlist open, rely on TLS, database credentials, and Retool resource permissions to protect access.

Build an admin tool

After the resource is connected, create MySQL queries in Retool and wire them to components:

• Use SQL mode for read queries that feed a Table, chart, or other display component.
• Use GUI mode actions such as Insert a record, Update an existing record, Update a record, or create a new record if it doesn't exist, Delete a record, Bulk insert records, Bulk update via a primary key, and Bulk upsert via a primary key for forms, imports, and editable tables.
• Bind table edits to the Save changes event and refresh the read query after writes complete.
• Show a confirmation modal before delete actions.

Reference component values with Retool's {{ }} embedded expressions. Retool converts MySQL queries to prepared statements by default, which separates values from SQL text and helps prevent SQL injection. Keep that protection enabled unless you have a specific, reviewed reason to disable it.

Use a branch for staging

Branches are API-created, isolated copies of a MySQL database with their own connection details. Create a branch for staging or preview work, fetch its connectionString, and configure a second Retool MySQL resource against that branch. Delete the branch when the staging tool is no longer needed.

Related