Connections

Every database you open in Lily is a saved connection. The connection manager shows them as cards, with the engine, the environment, a color and when you last opened it. Type in Find a connection… to filter by name, address or engine.

The ground rules

The last panel of the connection form, Set the ground rules, decides how careful Lily is with that database.

Environment

Pick one of None, Local, Testing, Development, Staging or Production. The environment shows as a pill on the card and in the workspace.

Production is the one that changes behavior:

• every write you run from the query editor asks for confirmation (see Guardrails);
• dashboards do not refresh by themselves when you open them;
• the card gets hazard stripes, and the form offers Make it read-only.

Read-only

Read-only makes Lily refuse UPDATE, DELETE, INSERT, DROP and other writes on that connection: in the query editor, inline edits, schema changes, imports, AI-generated SQL and the Redis, MongoDB and DynamoDB screens. A blocked statement fails with Read-only connection — writes are blocked.

It is a check Lily makes before each statement, not a read-only session on the server. For a hard guarantee, also connect with a user that can only read. See Guardrails.

Color

Auto uses the environment's color. Any other swatch overrides it for the card and the connection pill.

Groups

New Group creates a folder for connections, with a few suggestions (Work, Clients, Side projects, Production, Staging, Local). From a group's … menu you can add a connection to it, rename it or delete it. Deleting a group keeps its connections; they move to Ungrouped.

The card menu

The … menu on a card has Edit, Duplicate, Export…, Move to and Delete.

• Duplicate copies the connection, passwords included, as <name> copy.
• Delete removes the connection right away, along with its saved passwords, schema cache, drafts, AI analysis, table favorites and Trace data. There is no undo.

Connection URLs

Paste connection URL in the form reads the URL in your clipboard. Lily understands these schemes:

Scheme	Engine
postgres://, postgresql://	PostgreSQL
mysql://	MySQL and MariaDB
sqlserver://, mssql://	SQL Server
mongodb://, mongodb+srv://	MongoDB
redis://, rediss://	Redis
trino://	Trino
clickhouse://, clickhouses://	ClickHouse

From the URL Lily takes host, port, user, password, the database (the catalog for Trino) and TLS:

• sslmode turns TLS on unless it is disable; verify-ca and verify-full also turn on certificate verification;
• ssl=true, tls=true or ssl=require turn TLS on.

Other query parameters are ignored. SQLite and DynamoDB have no URL form, and neither do JDBC or key=value connection strings.

Opening links from other apps

Lily registers the lily:// scheme. A link like this opens a connection directly:

lily://connect?url=postgres%3A%2F%2Fapp%40db.internal%2Fshop&ssh=deploy@bastion.example.com&name=Shop

If the same database is already saved with its password, Lily connects at once; otherwise the form opens filled in. Passwords inside the link are ignored, and the SSH tunnel uses your SSH agent. Orbit's Open in Lily DB uses this.

Secrets stay in the Keychain

Database passwords, DynamoDB secret keys and SSH passwords or passphrases are stored in the macOS Keychain. The connections file on disk never contains them.

Import and export

Share in the connection manager has Export all connections… and Import connections…; a single connection exports from its card menu.

The export is a JSON file with hosts, ports, users, database names, the AWS access key ID, SSH host, user and key path, environment, color, read-only and the groups in use. It never includes passwords, secret keys or passphrases, so the person importing it adds their own with Edit.

Importing always creates new connections, so importing the same file twice gives you two copies.