---
layout: article
title: Network security
description: TLS by default, IP allowlists, and idle timeouts for your PostgreSQL database.
---

Every native database is reachable through a unique public hostname, secured with TLS, and protected by network controls that you configure per database.

# Hostname

Each database gets a stable hostname in the form:

```
db-<hash>.<region>.appwrite.center
```

The hostname does not change for the lifetime of the database, across restarts, resizes, failovers, and version upgrades. You can copy it from the Console credentials dialog or the database response.

# TLS

Connections on Appwrite Cloud are encrypted with TLS, terminated at Appwrite's edge and forwarded to your database over the internal network. The connection string from the credentials dialog carries the right SSL settings for your environment, so drivers need no extra configuration.

# IP allowlist

![Network settings](/images/docs/products/databases/postgresql/settings-network.avif)

By default, any host that has your credentials can reach the database over the public internet. To restrict access to known networks, configure an IP allowlist. Connections from addresses outside the allowlist are dropped at the network layer, before authentication.

In the Console, add entries under **Settings** > **Network**.

From the API, pass CIDR blocks or single addresses:

```server-nodejs
import { Client, Postgresql } from 'node-appwrite';

const client = new Client()
    .setEndpoint('https://<REGION>.cloud.appwrite.io/v1')
    .setProject('<PROJECT_ID>')
    .setKey('<YOUR_API_KEY>');

const postgresql = new Postgresql(client);

await postgresql.update({
    databaseId: '<DATABASE_ID>',
    networkIPAllowlist: ['203.0.113.0/24', '198.51.100.7'],
});
```
```server-deno
import { Client, Postgresql } from "npm:node-appwrite";

const client = new Client()
    .setEndpoint('https://<REGION>.cloud.appwrite.io/v1')
    .setProject('<PROJECT_ID>')
    .setKey('<YOUR_API_KEY>');

const postgresql = new Postgresql(client);

await postgresql.update({
    databaseId: '<DATABASE_ID>',
    networkIPAllowlist: ['203.0.113.0/24', '198.51.100.7'],
});
```
```server-php
<?php

use Appwrite\Client;
use Appwrite\Services\Postgresql;

$client = (new Client())
    ->setEndpoint('https://<REGION>.cloud.appwrite.io/v1')
    ->setProject('<PROJECT_ID>')
    ->setKey('<YOUR_API_KEY>');

$postgresql = new Postgresql($client);

$postgresql->update(
    databaseId: '<DATABASE_ID>',
    networkIPAllowlist: ['203.0.113.0/24', '198.51.100.7'],
);
```
```server-python
from appwrite.client import Client
from appwrite.services.postgresql import Postgresql

client = Client()
client.set_endpoint('https://<REGION>.cloud.appwrite.io/v1')
client.set_project('<PROJECT_ID>')
client.set_key('<YOUR_API_KEY>')

postgresql = Postgresql(client)

postgresql.update(
    database_id='<DATABASE_ID>',
    network_ip_allowlist=['203.0.113.0/24', '198.51.100.7'],
)
```
```server-ruby
require 'appwrite'

include Appwrite

client = Client.new
    .set_endpoint('https://<REGION>.cloud.appwrite.io/v1')
    .set_project('<PROJECT_ID>')
    .set_key('<YOUR_API_KEY>')

postgresql = Postgresql.new(client)

postgresql.update(
    database_id: '<DATABASE_ID>',
    network_ip_allowlist: ['203.0.113.0/24', '198.51.100.7'],
)
```
```server-dotnet
using Appwrite;
using Appwrite.Services;

Client client = new Client()
    .SetEndPoint("https://<REGION>.cloud.appwrite.io/v1")
    .SetProject("<PROJECT_ID>")
    .SetKey("<YOUR_API_KEY>");

Postgresql postgresql = new Postgresql(client);

await postgresql.Update(
    databaseId: "<DATABASE_ID>",
    networkIPAllowlist: new List<string> { "203.0.113.0/24", "198.51.100.7" }
);
```
```server-dart
import 'package:dart_appwrite/dart_appwrite.dart';

Client client = Client()
    .setEndpoint('https://<REGION>.cloud.appwrite.io/v1')
    .setProject('<PROJECT_ID>')
    .setKey('<YOUR_API_KEY>');

Postgresql postgresql = Postgresql(client);

await postgresql.update(
    databaseId: '<DATABASE_ID>',
    networkIPAllowlist: ['203.0.113.0/24', '198.51.100.7'],
);
```
```server-kotlin
import io.appwrite.Client
import io.appwrite.services.Postgresql

val client = Client()
    .setEndpoint("https://<REGION>.cloud.appwrite.io/v1")
    .setProject("<PROJECT_ID>")
    .setKey("<YOUR_API_KEY>")

val postgresql = Postgresql(client)

postgresql.update(
    databaseId = "<DATABASE_ID>",
    networkIPAllowlist = listOf("203.0.113.0/24", "198.51.100.7"),
)
```
```server-swift
import Appwrite

let client = Client()
    .setEndpoint("https://<REGION>.cloud.appwrite.io/v1")
    .setProject("<PROJECT_ID>")
    .setKey("<YOUR_API_KEY>")

let postgresql = Postgresql(client)

_ = try await postgresql.update(
    databaseId: "<DATABASE_ID>",
    networkIPAllowlist: ["203.0.113.0/24", "198.51.100.7"]
)
```
```server-go
package main

import (
    "github.com/appwrite/sdk-for-go/appwrite"
    "github.com/appwrite/sdk-for-go/postgresql"
)

func main() {
    client := appwrite.NewClient(
        appwrite.WithEndpoint("https://<REGION>.cloud.appwrite.io/v1"),
        appwrite.WithProject("<PROJECT_ID>"),
        appwrite.WithKey("<YOUR_API_KEY>"),
    )

    service := appwrite.NewPostgresql(client)

    _, err := service.Update(
        "<DATABASE_ID>",
        postgresql.WithUpdateNetworkIPAllowlist([]string{"203.0.113.0/24", "198.51.100.7"}),
    )
    if err != nil {
        panic(err)
    }
}
```
```server-rust
use appwrite::client::Client;
use appwrite::services::postgresql::Postgresql;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let client = Client::new()
        .set_endpoint("https://<REGION>.cloud.appwrite.io/v1")
        .set_project("<PROJECT_ID>")
        .set_key("<YOUR_API_KEY>");

    let postgresql = Postgresql::new(&client);

    postgresql.update("<DATABASE_ID>", None, None, None, None, None, None, Some(vec!["203.0.113.0/24".into(), "198.51.100.7".into()]), None, None, None, None, None, None, None, None, None, None, None, None, None).await?;

    Ok(())
}
```
```bash
curl -X PATCH \
  -H "X-Appwrite-Project: <PROJECT_ID>" \
  -H "X-Appwrite-Key: <API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{
      "networkIPAllowlist": [
          "203.0.113.0/24",
          "198.51.100.7"
      ]
  }' \
  https://<REGION>.cloud.appwrite.io/v1/postgresql/<DATABASE_ID>
```

Rules:

- Entries are IPv4 or IPv6 addresses or CIDR blocks, up to 100 entries per database.
- An empty allowlist means the database accepts connections from any address.
- The allowlist applies to the database port, the pooler port, and the SQL API. Appwrite's own traffic for backups, monitoring, and replication is unaffected.

**Don't lock yourself out**

If you connect from networks with changing addresses (home ISPs, mobile networks, serverless platforms without static egress), an allowlist can block you. Add your serverless provider's egress ranges, or leave the allowlist empty and rely on strong credentials and rotation.

# Idle timeout

`networkIdleTimeoutSeconds` sets how long a session may sit idle inside an open transaction before PostgreSQL ends it, 900 seconds by default and adjustable between 60 and 86400. It targets the case where an application opens a transaction and then stalls, holding locks and blocking other writers. A connection that is simply idle between queries is not affected.

This is separate from `idleTimeoutMinutes`, which controls how long the whole database sits without any connections before it scales down to zero. That one accepts 5 to 60 minutes and defaults to 15.

```server-nodejs
import { Client, Postgresql } from 'node-appwrite';

const client = new Client()
    .setEndpoint('https://<REGION>.cloud.appwrite.io/v1')
    .setProject('<PROJECT_ID>')
    .setKey('<YOUR_API_KEY>');

const postgresql = new Postgresql(client);

await postgresql.update({
    databaseId: '<DATABASE_ID>',
    networkIdleTimeoutSeconds: 900,
});
```
```server-deno
import { Client, Postgresql } from "npm:node-appwrite";

const client = new Client()
    .setEndpoint('https://<REGION>.cloud.appwrite.io/v1')
    .setProject('<PROJECT_ID>')
    .setKey('<YOUR_API_KEY>');

const postgresql = new Postgresql(client);

await postgresql.update({
    databaseId: '<DATABASE_ID>',
    networkIdleTimeoutSeconds: 900,
});
```
```server-php
<?php

use Appwrite\Client;
use Appwrite\Services\Postgresql;

$client = (new Client())
    ->setEndpoint('https://<REGION>.cloud.appwrite.io/v1')
    ->setProject('<PROJECT_ID>')
    ->setKey('<YOUR_API_KEY>');

$postgresql = new Postgresql($client);

$postgresql->update(
    databaseId: '<DATABASE_ID>',
    networkIdleTimeoutSeconds: 900,
);
```
```server-python
from appwrite.client import Client
from appwrite.services.postgresql import Postgresql

client = Client()
client.set_endpoint('https://<REGION>.cloud.appwrite.io/v1')
client.set_project('<PROJECT_ID>')
client.set_key('<YOUR_API_KEY>')

postgresql = Postgresql(client)

postgresql.update(
    database_id='<DATABASE_ID>',
    network_idle_timeout_seconds=900,
)
```
```server-ruby
require 'appwrite'

include Appwrite

client = Client.new
    .set_endpoint('https://<REGION>.cloud.appwrite.io/v1')
    .set_project('<PROJECT_ID>')
    .set_key('<YOUR_API_KEY>')

postgresql = Postgresql.new(client)

postgresql.update(
    database_id: '<DATABASE_ID>',
    network_idle_timeout_seconds: 900,
)
```
```server-dotnet
using Appwrite;
using Appwrite.Services;

Client client = new Client()
    .SetEndPoint("https://<REGION>.cloud.appwrite.io/v1")
    .SetProject("<PROJECT_ID>")
    .SetKey("<YOUR_API_KEY>");

Postgresql postgresql = new Postgresql(client);

await postgresql.Update(
    databaseId: "<DATABASE_ID>",
    networkIdleTimeoutSeconds: 900
);
```
```server-dart
import 'package:dart_appwrite/dart_appwrite.dart';

Client client = Client()
    .setEndpoint('https://<REGION>.cloud.appwrite.io/v1')
    .setProject('<PROJECT_ID>')
    .setKey('<YOUR_API_KEY>');

Postgresql postgresql = Postgresql(client);

await postgresql.update(
    databaseId: '<DATABASE_ID>',
    networkIdleTimeoutSeconds: 900,
);
```
```server-kotlin
import io.appwrite.Client
import io.appwrite.services.Postgresql

val client = Client()
    .setEndpoint("https://<REGION>.cloud.appwrite.io/v1")
    .setProject("<PROJECT_ID>")
    .setKey("<YOUR_API_KEY>")

val postgresql = Postgresql(client)

postgresql.update(
    databaseId = "<DATABASE_ID>",
    networkIdleTimeoutSeconds = 900,
)
```
```server-swift
import Appwrite

let client = Client()
    .setEndpoint("https://<REGION>.cloud.appwrite.io/v1")
    .setProject("<PROJECT_ID>")
    .setKey("<YOUR_API_KEY>")

let postgresql = Postgresql(client)

_ = try await postgresql.update(
    databaseId: "<DATABASE_ID>",
    networkIdleTimeoutSeconds: 900
)
```
```server-go
package main

import (
    "github.com/appwrite/sdk-for-go/appwrite"
    "github.com/appwrite/sdk-for-go/postgresql"
)

func main() {
    client := appwrite.NewClient(
        appwrite.WithEndpoint("https://<REGION>.cloud.appwrite.io/v1"),
        appwrite.WithProject("<PROJECT_ID>"),
        appwrite.WithKey("<YOUR_API_KEY>"),
    )

    service := appwrite.NewPostgresql(client)

    _, err := service.Update(
        "<DATABASE_ID>",
        postgresql.WithUpdateNetworkIdleTimeoutSeconds(900),
    )
    if err != nil {
        panic(err)
    }
}
```
```server-rust
use appwrite::client::Client;
use appwrite::services::postgresql::Postgresql;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let client = Client::new()
        .set_endpoint("https://<REGION>.cloud.appwrite.io/v1")
        .set_project("<PROJECT_ID>")
        .set_key("<YOUR_API_KEY>");

    let postgresql = Postgresql::new(&client);

    postgresql.update("<DATABASE_ID>", None, None, None, None, None, Some(900), None, None, None, None, None, None, None, None, None, None, None, None, None, None).await?;

    Ok(())
}
```
```bash
curl -X PATCH \
  -H "X-Appwrite-Project: <PROJECT_ID>" \
  -H "X-Appwrite-Key: <API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{
      "networkIdleTimeoutSeconds": 900
  }' \
  https://<REGION>.cloud.appwrite.io/v1/postgresql/<DATABASE_ID>
```

The same setting is available in the Console under **Settings** > **Network**.

# Locking down access

For a production database:

1. Set an IP allowlist covering only your application's egress addresses.
2. Rotate the [primary password](/docs/products/databases/postgresql/connections#rotate) on a schedule, and after anyone with access leaves your team.
3. Watch the [Connections tab](/docs/products/databases/postgresql/monitoring#connections) for unexpected clients.