Network security_

Every native database is reachable through a unique public hostname, secured with TLS, and protected by network controls that you configure per database.

Hostname

Each database gets a stable hostname in the form:

db-<hash>.<region>.appwrite.center

The hostname does not change for the lifetime of the database, across restarts, resizes, failovers, and version upgrades. You can copy it from the Console credentials dialog or the database response.

TLS

Connections on Appwrite Cloud are encrypted with TLS, terminated at Appwrite's edge and forwarded to your database over the internal network. The connection string from the credentials dialog carries the right SSL settings for your environment, so drivers need no extra configuration.

IP allowlist

By default, any host that has your credentials can reach the database over the public internet. To restrict access to known networks, configure an IP allowlist. Connections from addresses outside the allowlist are dropped at the network layer, before authentication.

In the Console, add entries under Settings > Network.

From the API, pass CIDR blocks or single addresses:

Rules:

• Entries are IPv4 or IPv6 addresses or CIDR blocks, up to 100 entries per database.
• An empty allowlist means the database accepts connections from any address.
• The allowlist applies to the database port, the pooler port, and the SQL API. Appwrite's own traffic for backups, monitoring, and replication is unaffected.

Idle timeout

networkIdleTimeoutSeconds sets how long a session may sit idle inside an open transaction before PostgreSQL ends it, 900 seconds by default and adjustable between 60 and 86400. It targets the case where an application opens a transaction and then stalls, holding locks and blocking other writers. A connection that is simply idle between queries is not affected.

This is separate from idleTimeoutMinutes, which controls how long the whole database sits without any connections before it scales down to zero. That one accepts 5 to 60 minutes and defaults to 15.

The same setting is available in the Console under Settings > Network.

Locking down access

For a production database:

1. Set an IP allowlist covering only your application's egress addresses.
2. Rotate the primary password on a schedule, and after anyone with access leaves your team.
3. Watch the Connections tab for unexpected clients.