# Spreadsheets and databases

Spreadsheets and databases connect under **Integrations**. The general rules (kinds of connection, card statuses, Read only, disconnecting) are on the [Connecting services](/help/integrations) page.

PostgreSQL is the only database in the catalog. Another database (MySQL, MS SQL and so on) cannot be connected directly; if a system on top of it has an HTTP API, connect it as a [Custom API](/help/custom-api). Yandex DataLens dashboards and datasets connect through a separate [integration](/integrations/yandex-datalens).

## Google Sheets

Sheets, cells and ranges of Google spreadsheets. More on the [integration page](/integrations/google-sheets).

### What the agent can do

Reads sheets and ranges and writes values into cells if the account has edit rights.

<TryPrompt prompt="Open the spreadsheet at the link … and total the Revenue column for October. Do not change anything in the spreadsheet." />

### Before you start

A Google account that sees the spreadsheets you need at sheets.google.com: the agent sees exactly the spreadsheets it sees.

### Steps

### Click Connect via Google
In the **Google Sheets** card click **Connect via Google** and sign in to the right account in a separate window.

### Give the agent the spreadsheet link
The Sheets API has no file list, so name the spreadsheet by its link or ID: the agent does not search by name.

### Permissions to grant

- **Writing**: the account needs the Editor role. Ask the file owner to click Share and add the account with that role. With Viewer or Commenter the agent only reads.
- **One spreadsheet**: connect a separate Google account without your files and share only the spreadsheet you need with it through Share. The agent sees only what you shared with that account.

### Limitations

- Google Drive is not part of the access: the agent works with spreadsheets only.
- An uploaded .xlsx file cannot be read over the API. Open it and choose **File → Save as Google Sheets**, then work with the copy.

### How to revoke access

Click **Disconnect** here. Access to a single spreadsheet is closed in the spreadsheet itself: remove the connected account from Share.

### Troubleshooting

- **The agent cannot find the spreadsheet**: give the link, not the name, and check that the spreadsheet is visible to the connected account.
- **Writing fails**: the account has the Viewer or Commenter role.
- **A corporate domain blocks access**: the Google Workspace admin opens Security → Access and data control → API controls and marks the app as Trusted.

## PostgreSQL

Read-only SQL over Supabase, Neon, Yandex Managed PostgreSQL, RDS and your own database. More on the [integration page](/integrations/postgres).

### What the agent can do

Runs read queries: SELECT, WITH, SHOW and EXPLAIN, one query per call. INSERT, UPDATE and any DDL are refused, even if the role has the rights.

### Before you start

- Owner access to the database to create a role.
- A public database address and an open port for the fixed Samreshuuu addresses listed in the requirements on the PostgreSQL connection page.

### Steps

### Create a read-only role
In the Supabase or Neon SQL Editor, otherwise in psql as the owner: `CREATE ROLE analytics_ro LOGIN PASSWORD '…'`. The role's password becomes the connection password.

### Grant read rights
`GRANT pg_read_all_data TO analytics_ro` (PostgreSQL 14 and newer). For older versions: `GRANT USAGE ON SCHEMA` and `GRANT SELECT ON ALL TABLES IN SCHEMA` for every schema, not only public.

### Open access to the database
Allow the database port in the firewall and `hostssl` in `pg_hba.conf` for this role, database and the addresses from the requirements. At a cloud provider set up the same rules.

### Fill in the form
**Host** (the server name from the certificate, without a protocol), **Port**, **Database**, the role's **Username** and **Password**. For your own CA upload the **Root certificate (sslrootcert)** in PEM.

### Permissions to grant

Read only: `pg_read_all_data` or `SELECT` on the schemas you need. The role needs no write rights, the connection would not use them anyway.

### Limitations

- `pg_read_all_data` does not bypass row-level security, and Supabase enables it almost everywhere: without a SELECT policy such tables return zero rows.
- The connection always uses TLS with chain and server name verification. The host must match the name in the certificate; an IP address needs an IP SAN.
- With the Supabase pooler the project's `.<ref>` is added to the username.

### How to revoke access

Click **Disconnect** here. In the database drop the role or change its password.

### Troubleshooting

- **A table returns zero rows**: row-level security is on with no SELECT policy for this role.
- **Connecting fails**: a successful read from DataLens or a check from the machine itself does not prove the database is open to the Samreshuuu addresses. Check the firewall and `pg_hba.conf` rules for exactly those addresses.
- **Certificate error**: the host does not match the name in the certificate, or your own CA's root certificate is not uploaded.