---
title: "Connect to an AMP database"
url: "https://docs.mekodata.ai/use-meko/amp/"
---

# Connect to an AMP database

Create a Postgres database in a datapack and connect to it from your own machine or app.

AMP is a Postgres database in a datapack. Use it when an app needs a database to connect to. Memories, files, and team knowledge stay in the datapack tools, not in AMP.

In Meko Cloud, anyone who can open the datapack can see its databases. Only the owner can create, change, or delete one. A member who is not the owner gets the same answer as a wrong datapack: not found.

Each tier has a compute budget, summed across all of your datapacks. Enterprise has no budget. Creating or resizing past the budget is refused.

## Connect from your own machine

A database has one writer endpoint, and you choose how it is reached when you create it. You cannot change that later.

1. Tell the agent you will connect from your own machine, an app, or an agent outside Meko, and give it the addresses you connect from. Each entry is an address or a range no broader than a `/24` (IPv4) or a `/48` (IPv6), such as `203.0.113.10/32` or an office egress range.
2. Ask the agent to create the endpoint as a public endpoint (`ingress_external`) with those addresses.
3. Save the password the agent shows you. The first writer on a new database sets that password once. It is not shown again.
4. Use the endpoint address the agent returns. Creating the database together with its writer does not include the address. The agent lists the endpoints to get it. Creating the endpoint on its own returns the address in that response.

A default endpoint (`cluster_ip`) is reachable only from inside Meko. If you need to connect from your own machine and the endpoint was created that way, delete the writer and create it again as a public endpoint.

A public endpoint cannot be opened to every address on the internet. An allow list that is missing a prefix, that uses `0.0.0.0`, or that is broader than a `/24` (IPv4) or a `/48` (IPv6) is refused before anything is created.

## Passwords

A fork's writer uses the parent database's password. The agent gets a notice instead of a new password.

A later writer on a database that already has a password can return a generated password that will not log in. Use the original password.

A read-only endpoint does not take a password.

Log in as the user the endpoint reports. When it reports none, the endpoint predates that field: use `cloud_admin`. If `cloud_admin` is rejected, try `admin`. The password is the same either way.