YugabyteDB Aeon exposes a Postgres-compatible query layer (**YSQL**). That is the only
API oke's `postgres` driver targets — not YCQL.

<Callout title="The one rule">
  In **Connect → Connect to your Application**, choose **YSQL** and download the CA cert. Port
  **5433** is the YSQL default — not Postgres's 5432.
</Callout>

## Find credentials (current console)

1. YugabyteDB Aeon → **Clusters** → select the cluster.
2. Click **Connect**.
3. Click **Connect to your Application**.
4. Click **Download CA Cert** and install it where the app can read it.
5. Select API **YSQL** (not YCQL).
6. Pick address mode: **Private Address** / **Private Service Endpoint** if VPC-peered;
   **Public Address** only if **Settings → Network Access → Public Access** is enabled
   (not recommended for production).
7. Copy **Connection String** (or Parameters) into `DATABASE_URL`.

```bash title="process env"
DATABASE_URL=postgresql://admin:…@….aws.yugabyte.cloud:5433/yugabyte?ssl=true&sslmode=verify-full&sslrootcert=/path/to/root.crt
```

Also add your app's IPs (or peered VPC) to the cluster **IP allow list** before
connecting.

## Production guidance

| Topic   | Guidance                                                                      |
| ------- | ----------------------------------------------------------------------------- |
| API     | **YSQL only** — YCQL is Cassandra-wire, useless to `postgres`                 |
| TLS     | `sslmode=verify-full` + downloaded CA                                         |
| Network | Prefer private / PSE; public access is an explicit opt-in                     |
| License | Core is **Apache 2.0** (including once-enterprise features in the core build) |

No Neon-style pooled hostname toggle — connection limits and load balancing are
cluster/VPC topology concerns. Smart drivers want a peered VPC; otherwise they probe
unreachable nodes first and add latency.

## Query performance

<Callout title="Already preloaded">
  YSQL exposes `pg_stat_statements` without an oke `command`. Create the extension, then open Store
  → **Performance**.
</Callout>

| Step    | What you do                                         |
| ------- | --------------------------------------------------- |
| Preload | Yugabyte (already on)                               |
| Create  | `CREATE EXTENSION IF NOT EXISTS pg_stat_statements` |
| Advisor | Not in the default catalog — CTA only               |

Do not invent a Postgres `command` overlay for Aeon or the Docker recipe.

## Real gotcha — wrong API tab

Copying **YCQL** parameters (port **9042**) into `DATABASE_URL` fails immediately —
different protocol. Always confirm the Connect dialog shows **YSQL** and port **5433**.

## Troubleshooting

<Accordions>
<Accordion title="Connection timed out / could not connect to server">

IP allow list or Public Access. Add the client IP under network settings, or use the
private address from a peered VPC. Public hostname stays dark until Public Access is on.

</Accordion>
<Accordion title="SSL error with verify-full">

CA not downloaded or `sslrootcert` path wrong. Re-run **Download CA Cert** from the
Connect dialog and point the URI at that file.

</Accordion>
</Accordions>

## Learn more

- [CockroachDB](/docs/providers/cockroachdb) — license / feature comparison
- [YugabyteDB (self-hosted)](/docs/recipes/yugabytedb) — single-node Docker recipe
- [Postgres (image)](/docs/recipes/postgres) — driver this backs
- [Store · SQL](/docs/elements/store#sql) — schema workflows

## Next

<Cards>
  <Card
    title="CockroachDB"
    description="Compare licensing and features."
    href="/docs/providers/cockroachdb"
  />
  <Card
    title="Supabase"
    description="Managed single-node option."
    href="/docs/providers/supabase"
  />
  <Card
    title="Redis Cloud"
    description="Managed Redis-side pair."
    href="/docs/providers/redis-cloud"
  />
</Cards>