---
title: Connection strings
description: The session and transaction pooler connection strings sherbase returns, TLS verification, and the libpq < 16 fallback.
---

# Connection strings

`base_create_database` returns two connection strings, both through the
same pooler at the public host `db.shebang.pro`:

```
postgres://<role>.<tenant>:<password>@db.shebang.pro:5432/<db>?sslmode=verify-full&sslrootcert=system
postgres://<role>.<tenant>:<password>@db.shebang.pro:6543/<db>?sslmode=verify-full&sslrootcert=system
```

- **Session pooler (5432)** — the general-purpose string; use this
  unless you have a specific reason to use the other one.
- **Transaction pooler (6543)** — for serverless platforms, Prisma, and
  Drizzle. Prepared statements are not supported in transaction mode, so
  a client or ORM that relies on them needs the session pooler instead.

`<role>` and `<db>` are both `base_<slug>`; `<tenant>` namespaces the
username the way Supavisor expects. The password is the one
`base_create_database` (or a rotation) showed you once — it's not
retrievable again, so if it's lost, regenerate it from the dashboard.

## TLS verification

Both strings carry `sslmode=verify-full&sslrootcert=system`:
`verify-full` checks the server's certificate and hostname;
`sslrootcert=system` tells libpq to verify that certificate against the
OS trust store, which is what lets `verify-full` succeed against a
public CA (Let's Encrypt) certificate.

`sslrootcert=system` needs **libpq 16 or newer** — the client library
`psql` or your driver links against, not the server version. On an
older libpq, download the
[ISRG Root X1 certificate](https://letsencrypt.org/certs/isrgrootx1.pem)
and use `sslrootcert=<path>` instead of `sslrootcert=system`.

## Next

[The Data API](/sherbase/the-data-api).