> For the complete documentation index, see [llms.txt](https://docs.spice.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.spice.ai/docs/portal/external-data-sources.md).

# External Data Sources

Access and query external data sources in addition to community datasets including the ability to execute SQL joins across both by [creating custom datasets](/docs/portal/datasets-and-views.md).

External Data Sources initially supports connecting to [PostgreSQL](https://www.postgresql.org/) and [MySQL](https://www.mysql.com/) with more data sources coming soon.

### Adding an External Data Source

External Data Sources are added and managed through [organizations](/docs/portal/organizations.md) and are available to all Spice projects within the organization. They are private and are not visible or accessible to projects in other organizations.

Navigate to the organization's **Settings** and then the **Data Sources** section.

Click **Add Data Source** to show the **New Data Source** dialog.

Select the data source and then complete the required connection details.

Once the data source is connected the data source will be made available through its **name**, which will be the schema name for SQL queries. E.g. naming the data source connection "**mydb**" will enable selecting tables with the SQL ` SELECT * FROM`` `` `**`mydb`**`.{table}.`, click the vertical dots to the right of the connection to edit or delete it.

To edit or delete the data source, click the vertical ellipses menu.

### TLS and certificate verification

Connections to PostgreSQL and MySQL data sources are encrypted with TLS by default. When the connection details name an SSL mode, that mode is used. When they do not, Spice.ai resolves one instead of falling back to a mode that permits an unencrypted connection.

**PostgreSQL**

| Connection string                       | Resolved `sslmode`                                                      |
| --------------------------------------- | ----------------------------------------------------------------------- |
| No `sslmode`                            | `verify-full` — the certificate chain and the hostname are both checked |
| No `sslmode`, Amazon RDS or Aurora host | `require` — TLS is required, the certificate is not verified            |
| Any explicit `sslmode`                  | Used verbatim, including `disable`                                      |

Amazon RDS and Aurora endpoints resolve to `require` rather than `verify-full` because their certificates are issued by Amazon's private per-region certificate authorities, which the system trust store does not carry. Encryption stays mandatory for these hosts.

Amazon's RDS root certificate authorities *are* trusted when Spice.ai tests a connection, so testing an RDS or Aurora source that asks for `sslmode=require` or stronger succeeds without any additional certificate configuration.

{% hint style="warning" %}
Configuring a PostgreSQL source for [database replication](https://github.com/spicehq/docs/tree/trunk/features/database-replication-and-cdc.md) requires TLS with a verified certificate. A connection string is refused when it turns TLS off (`sslmode=disable`, `ssl=0`), accepts whatever certificate the server presents (`sslmode=no-verify`), or checks the certificate chain without checking that the certificate was issued for the host (`uselibpqcompat=true` with `require` or `verify-ca`). Use `sslmode=verify-full`.
{% endhint %}

Testing a saved connection honors the mode the connection stores rather than refusing it, so a data source that names a weaker mode explicitly keeps that mode.

**MySQL**

| Connection string                                                        | Resolved `mysql_sslmode` |
| ------------------------------------------------------------------------ | ------------------------ |
| No SSL parameter                                                         | `required`               |
| No SSL parameter, Amazon RDS or Aurora host                              | `preferred`              |
| `sslmode=disabled`, `tls=false`                                          | `disabled`               |
| `sslmode=preferred`, `tls=skip-verify`, `sslaccept=accept_invalid_certs` | `preferred`              |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.spice.ai/docs/portal/external-data-sources.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.