# Connection errors (/docs/troubleshooting)

When you click **Connect database**, backupd only checks that the connection string is well formed. The first real connection happens on the first backup, so most connection problems show up as a failed backup with one of the messages below. Click **Backup now** after adding a database to find out straight away.

## Connection string format [#connection-string-format]

### That connection string isn't a valid URL [#that-connection-string-isnt-a-valid-url]

The string couldn't be parsed. Check for spaces, and percent-encode special characters in the user or password (`@` as `%40`, `/` as `%2F`, `:` as `%3A`, `#` as `%23`).

### A postgres connection string starts with postgres:// or postgresql:// [#a-postgres-connection-string-starts-with-postgres-or-postgresql]

The scheme doesn't match the engine you picked. MySQL strings start with `mysql://`, MongoDB strings with `mongodb://` or `mongodb+srv://`.

### Add the database name to the connection string (mysql://user:pass@host:3306/database) [#add-the-database-name-to-the-connection-string-mysqluserpasshost3306database]

MySQL connections back up one database each. Add its name to the path.

### Use your deployment URL, e.g. https://happy-otter-123.convex.cloud [#use-your-deployment-url-eg-httpshappy-otter-123convexcloud]

For Convex Cloud, enter the deployment URL, not the dashboard URL. For a self-hosted backend, choose the **Self-hosted** tab.

### Use an https:// deployment URL [#use-an-https-deployment-url]

Convex deployments must be reached over HTTPS.

### The connection option "…" isn't supported [#the-connection-option--isnt-supported]

The MongoDB connection string has an option backupd doesn't accept. Remove it. See the [supported options](/docs/databases/mongodb#authentication-and-options).

### Use SCRAM authentication (authMechanism=SCRAM-SHA-256) [#use-scram-authentication-authmechanismscram-sha-256]

MongoDB connections must use SCRAM. Remove other `authMechanism` values.

## TLS [#tls]

### backupd connects over TLS; remove sslmode=disable [#backupd-connects-over-tls-remove-sslmodedisable]

PostgreSQL. Remove `sslmode=disable`, or set `sslmode=require`. The server must accept TLS connections.

### backupd connects over TLS; remove ssl-mode=DISABLED [#backupd-connects-over-tls-remove-ssl-modedisabled]

MySQL. Remove `ssl-mode=DISABLED`, or set `ssl-mode=REQUIRED`.

### backupd connects over TLS; add tls=true to the connection string [#backupd-connects-over-tls-add-tlstrue-to-the-connection-string]

MongoDB with a `mongodb://` address. Add `tls=true`, or use the `mongodb+srv://` address your provider gives you.

### Unknown sslmode "…" or Unknown ssl-mode "…" [#unknown-sslmode--or-unknown-ssl-mode-]

Use one of the supported values: `require`, `verify-ca` or `verify-full` for PostgreSQL, `REQUIRED`, `VERIFY_CA` or `VERIFY_IDENTITY` for MySQL.

## Network [#network]

### db.internal:5432 resolves to a private or reserved address, which backupd can't reach [#dbinternal5432-resolves-to-a-private-or-reserved-address-which-backupd-cant-reach]

The host resolves to a private, loopback or link-local address. backupd only connects to public addresses. Use your database's public hostname. Private networks and SSH tunnels aren't supported yet.

### Couldn't resolve db.example.com or Couldn't resolve the SRV record [#couldnt-resolve-dbexamplecom-or-couldnt-resolve-the-srv-record]

The hostname doesn't exist in DNS. Check it for typos, and that the database's public endpoint is turned on.

### Couldn't reach the database [#couldnt-reach-the-database]

backupd couldn't open a connection. Check that the database is running, that the port is right, and that your firewall or your provider's allow list includes [backupd's addresses](/docs/databases#firewall-allow-list). This error is retried automatically.

### Couldn't connect to PostgreSQL: timed out (or MySQL, MongoDB) [#couldnt-connect-to-postgresql-timed-out-or-mysql-mongodb]

The connection didn't complete in time. Usually a firewall silently dropping the connection. Allow [backupd's addresses](/docs/databases#firewall-allow-list) through.

## Credentials and permissions [#credentials-and-permissions]

### The database rejected backupd's credentials [#the-database-rejected-backupds-credentials]

The user or password is wrong, or the server doesn't allow this user to connect from outside (for PostgreSQL, a missing `pg_hba.conf` entry). Connection strings can't be edited, so add the database again with the right credentials. See [Change the connection string](/docs/databases#change-the-connection-string).

### The backup user is missing a privilege [#the-backup-user-is-missing-a-privilege]

The user can connect but can't read everything. Grant the permissions for your engine: [PostgreSQL](/docs/databases/postgresql#permissions), [MySQL](/docs/databases/mysql#permissions), [MongoDB](/docs/databases/mongodb#permissions).

### Convex rejected the deploy key [#convex-rejected-the-deploy-key]

The key is wrong, revoked or for another deployment. Create a new production deploy key in the Convex dashboard. For self-hosted backends, generate a new admin key.

### The deploy key can't export or import data [#the-deploy-key-cant-export-or-import-data]

Use a production deploy key, or an admin key for self-hosted Convex.

## Versions [#versions]

### PostgreSQL … isn't supported [#postgresql--isnt-supported]

backupd supports PostgreSQL 9.2 to 18. The message names your server's version.

### … isn't supported (MySQL 5.7+ or MariaDB 10.3+) [#-isnt-supported-mysql-57-or-mariadb-103]

backupd supports MySQL 5.7 and later and MariaDB 10.3 and later. Upgrade the server to back it up with backupd.

### MongoDB … isn't supported (4.2+) [#mongodb--isnt-supported-42]

backupd supports MongoDB 4.2 and later.