Connect to TiDB Cloud Starter or Essential via Public Endpoint

This document describes how to connect to your TiDB Cloud Starter or TiDB Cloud Essential instance via a public endpoint, using a SQL client from your computer, as well as how to disable a public endpoint.

Choose an endpoint model

Depending on your TiDB Cloud plan, choose the appropriate endpoint model:

• For TiDB Cloud Starter instances or for TiDB Cloud Essential instances created before July 1, 2026, use the endpoint shared model. In this model, a single public endpoint can be shared by multiple TiDB Cloud Starter and Essential instances in the same region.
• For TiDB Cloud Essential instances created starting July 1, 2026, use the endpoint exclusive model. In this model, each TiDB Cloud Essential instance uses its own standalone public endpoint. This model eliminates the need to include the account prefix when connecting, but you need to repeat the setup steps for each TiDB Cloud Essential instance.

Connect via a public endpoint (endpoint shared model)

To connect to a TiDB Cloud Starter or TiDB Cloud Essential instance via public endpoint using the shared model, take the following steps:

1. Navigate to the My TiDB page, and then click the name of your target TiDB Cloud Starter or Essential instance to go to its overview page.

2. Click Connect in the upper-right corner. A connection dialog is displayed.

3. In the dialog, keep the default setting of the connection type as Public, and select your preferred connection method and operating system to get the corresponding connection string.

   Note

   • Keeping the connection type as Public means the connection is via standard TLS connection. For more information, see TLS Connection to TiDB Cloud Starter or Essential.

   • If you choose Private Endpoint in the Connection Type drop-down list, it means that the connection is via private endpoint. For more information, see the following documents:

     • Connect to TiDB Cloud Starter or Essential via AWS PrivateLink
     • Connect to TiDB Cloud Starter or Essential via Alibaba Cloud Private Endpoint

4. TiDB Cloud lets you create branches for your TiDB Cloud Starter instance. After a branch is created, you can choose to connect to the branch via the Branch drop-down list. main represents the TiDB Cloud Starter instance itself.

5. If you have not set a password yet, click Generate Password to generate a random password. The generated password will not show again, so save your password in a secure location.

6. Connect to your TiDB Cloud Starter or Essential instance with the connection string.

   Note

   When you connect to a TiDB Cloud Starter or TiDB Cloud Essential instance, you must include the prefix for your TiDB Cloud Starter or Essential instance in the user name and wrap the name with quotation marks. For more information, see User name prefix. Your client IP must be in the allowed IP rules of the public endpoint of your TiDB Cloud Starter or Essential instance. For more information, see Configure TiDB Cloud Starter or Essential Firewall Rules for Public Endpoints.

Connect via a public endpoint (endpoint exclusive model)

In the endpoint exclusive model, each TiDB Cloud Essential instance uses its own standalone public endpoint. This model eliminates the need to include the account prefix when connecting, but you need to repeat the setup steps for each TiDB Cloud Essential instance.

To connect to a TiDB Cloud Essential instance via a public endpoint using the exclusive model, take the following steps:

1. Open the overview page of the target instance.

   1. Log in to the TiDB Cloud console and navigate to the My TiDB page.

      Tip

      If you are in multiple organizations, use the combo box in the upper-left corner to switch to your target organization first.

   2. Click the name of your target instance to go to its overview page.

2. Click Connect in the upper-right corner. A connection dialog is displayed.

3. In the connection dialog, select Public from the Connection Type drop-down list.

   • If the public connection is disabled, click Settings > Networking in the left pane, and then enable the Public Endpoint option on the Networking page.
   • If you have not configured the IP access list, click Configure IP Access List to configure it before your first connection.
   • If you have not configured a root password for your TiDB Cloud Essential instance, click Set Root Password and set it.

4. Click CA cert to download the CA cert for TLS connection to TiDB Cloud Essential instances. The CA cert supports TLS 1.2 by default.

5. Choose your preferred connection method in the Connection with drop-down list, and then refer to the connection string to connect to your instance.

Disable a public endpoint

If you do not need to use a public endpoint of a TiDB Cloud Starter or TiDB Cloud Essential instance, you can disable it to prevent connections from the internet:

1. Navigate to the My TiDB page, and then click the name of your target TiDB Cloud Starter or Essential instance to go to its overview page.

2. In the left navigation pane, click Settings > Networking.

3. On the Networking page, click Disable for Public Endpoint. A confirmation dialog is displayed.

4. Click Disable in the confirmation dialog.

After disabling the public endpoint, the Public entry in the Connection Type drop-down list of the connect dialog is disabled. If users are still trying to access the TiDB Cloud Starter or Essential instance from the public endpoint, they will get an error.

You can re-enable the public endpoint after disabling it:

1. Navigate to the My TiDB page, and then click the name of your target TiDB Cloud Starter or Essential instance to go to its overview page.

2. In the left navigation pane, click Settings > Networking.

3. On the Networking page, click Enable.

What's next

After you have successfully connected to your TiDB Cloud Starter or Essential instance, you can explore SQL statements with TiDB.