> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bagofwords.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SQL databases

> Reference for the database and query-engine connectors that need only network access and a login

This is a reference page for the connectors that need no external app registration, tenant setting, or admin consent — just **network access from the Bag of words host** and a **login with read permission**. Add them under **Data Sources → Add data source**, fill in the fields below, test the connection, and pick the tables the agent may use.

Connectors with real external setup have their own pages: [Snowflake](/data-sources/connectors/snowflake), [Google BigQuery](/data-sources/connectors/bigquery), and [Microsoft SQL Server](/data-sources/connectors/sql-server).

<Note>
  Most of these support both a **shared** credential (one login for the whole workspace) and **per-user** credentials (each person authenticates as themselves). Per-user authentication on a database connector requires an Enterprise license — see [Authentication](/data-sources/authentication). Where a mode is shared-only, it is marked below.
</Note>

## All connectors

| Connector | Config fields | Auth modes | Notes |
| :- | :- | :- | :- |
| **PostgreSQL** `postgresql` | `host`, `port` (5432), `database`, `schema` | Username / Password | `schema` is optional and takes a comma-separated list. |
| **MySQL** `mysql` | `host`, `port`, `database` | Username / Password | `user` and `password` may both be blank for anonymous access. |
| **MariaDB** `mariadb` | `host`, `port`, `database` | Username / Password | Same shape as MySQL. |
| **Oracle Database** `oracledb` | `host`, `port` (1521), `service_name`, `schema`, `use_tcps` (false), `verify_ssl` (true) | Username / Password | Connect by **service name**, not SID. |
| **SQLite** `sqlite` | `database` | No auth *(shared only)* | `database` is an absolute path on the Bag of words host. |
| **DuckDB** `duckdb` | `uris` | No auth *(shared)*, AWS Keys *(shared)*, GCP Service Account, Azure Connection String *(shared)* | Queries files in object storage as views. See below. |
| **ClickHouse** `clickhouse` | `host`, `port` (8123), `database`, `secure` (true) | Username / Password | `database` is optional and takes a comma-separated list; blank means all databases. |
| **Trino** `trino` | `host`, `port` (8080), `catalog`, `schema`, `protocol` (`http`) | Username / Password | `catalog` and `schema` are both required. See below. |
| **Vertica** `vertica` | `host`, `port` (5433), `database`, `schema` (`public`) | Username / Password | |
| **Teradata Vantage** `teradata` | `host`, `port` (1025), `database`, `logmech` (`TD2`) | Username / Password | `database` is the namespace (≈ schema) and takes a comma-separated list. See below. |
| **Apache Druid** `druid` <sup>beta</sup> | `host`, `port` (8082), `secure` (false), `path` (`/druid/v2/sql/`), `schema` | Username / Password, API Token (Bearer), API Token (Basic) | Queried through the Broker or Router SQL API. See below. |
| **Apache Pinot** `pinot` <sup>beta</sup> | `host`, `port` (8099), `secure` (true), `path` (`/query/sql`), `controller`, `query_options` | Username / Password | Queried through the Broker SQL API. See below. |
| **MongoDB** `mongodb` | `host`, `port` (27017), `database`, `auth_source` (`admin`), `tls` (false), `use_srv` (false) | Username / Password | Document-shaped, not tabular. See below. |
| **Sybase SQL Anywhere** `sybase` <sup>EE</sup> | `host`, `port` (2638), `database` | Username / Password | Connected over TDS via FreeTDS. |
| **Spark** `spark_connect` | `host`, `port` (15002), `use_ssl` (false), `catalog`, `database`, `require_partition_filter` (false) | No auth *(shared)*, Bearer Token | Spark Connect (`sc://`). See below. |
| **Databricks SQL** `databricks_sql` | `server_hostname`, `http_path`, `catalog`, `schema` | Personal Access Token | `schema` takes a comma-separated list; blank discovers all schemas in the catalog. |
| **Azure Data Explorer** `azure_data_explorer` | `cluster_url`, `database` | Service Principal (AAD App) | Kusto. Auth fields are `client_id`, `client_secret`, `tenant_id`. |
| **AWS Redshift** `aws_redshift` | `host`, `port` (5439), `database`, `schema` (`public`), `region`, `cluster_identifier`, `ssl_mode` (`require`), `timeout` (30) | Username / Password, AWS Keys (IAM), Assume Role (ARN) | See below. |
| **AWS Athena** `aws_athena` <sup>beta</sup> | `region`, `database`, `workgroup` (`primary`), `s3_output_location`, `data_source` (`AwsDataCatalog`) | AWS Default (IAM Role / Instance Profile), AWS Access Keys | See below. |

<sup>beta</sup> Beta connector — the shape of the integration may still change.
<sup>EE</sup> Part of the **Enterprise Edition**.

## Notes on specific connectors

### DuckDB

DuckDB is not a server connection. `uris` holds either the path to a local `.duckdb` file, or **one URI pattern per line** pointing at parquet or CSV files, which Bag of words registers as views and queries in-process. Wildcards are supported:

```text theme={null}
s3://analytics-lake/events/*.parquet
az://container/exports/2024/*/*.csv
/data/reference/dim_customer.parquet
```

Pick the auth mode matching the backing store, not DuckDB itself:

| Mode | Fields | Scope |
| :- | :- | :- |
| No Auth (public/local) | — | Shared |
| AWS Keys | `access_key`, `secret_key`, `region`, `session_token` | Shared |
| GCP Service Account | `service_account_json` | Shared or per-user |
| Azure Connection String | `connection_string` (SAS or account key) | Shared |

`session_token` is only for temporary AWS credentials. Local paths and `file:/` URIs work with no auth at all.

### ClickHouse

Connects over the HTTP interface — `8123` for plain HTTP, `8443` with `secure` on (the usual setting for ClickHouse Cloud). The password cannot be blank, so create a dedicated user rather than relying on a passwordless `default`.

When `database` lists several databases, queries run against the first one; agents should qualify tables in the others as `db.table`.

ClickHouse supports [custom tables](/bow-fast/custom-queries): scheduled, locally cached query results that agents answer from instead of querying the service each time. On ClickHouse Cloud that lets an idle service stay idle — see [Cut ClickHouse Cloud costs](/bow-fast/clickhouse-cloud-costs). For that, the user needs `SELECT` on the source tables and on `system.parts` (used to estimate scan size), and `KILL QUERY` so an aborted refresh can stop its own query on the server. `Enum` columns are stored in the cached copy as their labels.

### Trino

`catalog` and `schema` are both required — a Trino connection is scoped to a single catalog/schema pair, so create one data source per pair you want the agent to reach. Set `protocol` to `https` for a TLS-terminated coordinator; the `password` field is only needed in that case.

### Teradata

`logmech` selects the logon mechanism: `TD2` for native Teradata users, or `LDAP`, `KRB5`, or `TDNEGO` for directory-based logon, which is common on-prem. `host` is the TPA or COP name of the system.

### Apache Druid

Set `secure` to true for HTTPS, and adjust `port` for what you are pointing at — `8082` for a Broker, `8888` for a Router. `schema` defaults to `druid`; system schemas are always excluded from indexing.

Two token modes exist and they are not interchangeable:

* **API Token (Bearer)** sends `Authorization: Bearer <token>`.
* **API Token (Basic)** sends the `basic_token` value verbatim as `Authorization: Basic <token>`, with **no base64 encoding**. Use this one for Imply Polaris `pok_…` API keys.

### Apache Pinot

Points at the Broker SQL endpoint. `controller` is an optional controller base URL (for example `http://controller-host:9000`), used for richer metadata. `query_options` passes a Pinot `queryOptions` string through on every query — `useMultistageEngine=true` is the common one.

### MongoDB

The only document-shaped connector here: the agent sees collections and inferred document structure rather than tables and columns, and writes MongoDB queries rather than SQL.

For **Atlas**, set `use_srv` to true — the connection then uses `mongodb+srv://`, `port` is ignored, `auth_source` is ignored, and TLS is automatic. For a self-hosted deployment, leave `use_srv` off and set `tls` and `auth_source` yourself. `user` and `password` may both be blank for an unauthenticated deployment.

### Spark

Runs Spark SQL against a remote cluster over **Spark Connect** (`sc://`). Compute stays on the cluster — Bag of words sends SQL and receives results, with no in-process engine on the Bag of words server.

Leave `catalog` blank to use the session default, and `database` blank to discover all databases (it also takes a comma-separated list). `require_partition_filter` is a guardrail worth turning on for large lakehouse tables: queries that would scan a partitioned table without filtering on a partition column are rejected via `EXPLAIN` before they run.

The **No auth** mode assumes the Spark Connect endpoint is network-gated — behind a VPN or Tailscale, for example. Otherwise use a Bearer Token.

### AWS Redshift

Three auth modes, all of which still require a `user`:

| Mode | Fields | What it does |
| :- | :- | :- |
| Username / Password | `user`, `password` | Ordinary Redshift database login. |
| AWS Keys (IAM) | `user`, `access_key`, `secret_key` | Authenticates with IAM credentials rather than a database password. |
| Assume Role (ARN) | `user`, `role_arn` | Assumes the named role and connects with the resulting temporary credentials, refreshed automatically before expiry. |

`region` is needed for both IAM modes. `cluster_identifier` identifies the cluster for IAM-based credential issuance. Leave `ssl_mode` at `require` unless you have a reason not to.

### AWS Athena

Athena is serverless: there is no host or port, only a `region` and a Glue `database`. `data_source` is the Athena catalog name and stays `AwsDataCatalog` for the standard Glue Data Catalog.

`s3_output_location` is where Athena writes query results. Leave it blank **only if** your `workgroup` has a default output location configured; otherwise set it to an S3 URI the identity can write to, since Athena cannot return results without one.

The default auth mode, **AWS Default (IAM Role / Instance Profile)**, takes no fields at all — it uses the ambient AWS credentials of the Bag of words host, which is the right choice when it runs on EC2, ECS, or EKS with an attached role. Otherwise use **AWS Access Keys**, which takes `access_key`, `secret_key`, and `role_arn`.

## Related

* [Data sources overview](/data-sources/overview)
* [Connecting data sources](/data-sources/connecting)
* [Authentication](/data-sources/authentication)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.