PostgreSQL

Databases Host, user and password Windmill docs

Query and update Postgres from any Windmill script, flow or app. SQL runs natively — and INSERT, UPDATE or DELETE can start a run of their own.

Set up in 3 steps

Collect the connection details

You need the host, port, database name, user and password — plus the SSL mode your server expects. Managed providers show all of these on the instance page.

Add the resource in Windmill

Open Resources, add a resource of type postgresql and fill the fields. Leave sslmode alone unless your server refuses the connection without it.

Write a SQL script

Pick PostgreSQL as the script language and write plain SQL against the resource — no client library, no boilerplate.

Scripts

Building blocks, if none of the projects above fit. Fork one, run it, or call it as a step inside your own flow.

Submit a script →

Flows

Multi-step workflows that already wire PostgreSQL to something else.

All flows →

Upon new user signup, check for existence in postgres, hash password, add record to postgres and airtable, send an email to new user.

Flow postgresql airtable +1 Verified

See account data over the last 3 days as a pie chart

Flow showcase slack +1 Verified

Ban a user, notify them by email, and us by Slack

Flow postgresql slack +1 Verified

Trigger flows from PostgreSQL

PostgreSQL is not only a destination. These inbound paths are supported today.

Database triggers

Windmill follows the database's logical replication stream and starts a run on INSERT, UPDATE or DELETE — on chosen tables, a schema, or everything. Self-hosted only.

Resource type

The shape of the credential every script on this page expects.

postgresql

View raw schema →

Field	Type	Required	What it is
accept_invalid_certs	boolean	No	Accept any certificate presented by the server, which disables TLS certificate verification and is not recommended. Only applies to verify-ca/verify-full.
dbname	string	Yes	The database name
host	string	No	The instance host
password	string	Yes	The postgres users password
port	integer	No	The instance port
region	string	No	AWS region for IAM auth (e.g. us-east-1). Falls back to AWS_REGION env var if not set.
root_certificate_pem	string	No	The root certificate in pe format
sslmode	string	No	Most cloud databases (Heroku, AWS, Supabase, etc.) require SSL. Self-hosted databases typically don't.
use_iam_auth	boolean	No	Use IAM authentication (AWS RDS/Aurora). When enabled, the password field is ignored and a short-lived IAM token is generated instead.
user	string	Yes	The postgres username

Questions

Are my credentials stored on the hub?

Never. They live only in your own Windmill workspace, encrypted at rest.

Do I need an external database at all?

Not always. Windmill data tables are managed relational storage, scoped to a workspace, with no host, password or connection string to configure. Reach for your own Postgres when the database already exists, or when something outside Windmill has to read it too.

Can I connect without storing a password?

On AWS RDS and Aurora, yes: enable use_iam_auth and workers mint a short-lived IAM token per connection instead. Enterprise Edition only.

Do I have to write TypeScript to query?

No. A PostgreSQL script is plain SQL. The scripts below exist for cases where you want to build the query in code.