Connecting to cloud data

DataHub can connect a service workspace to cloud databases and API-backed data sources. The sections below cover collecting the right credentials, configuring the connection, verifying access, and fixing the most common provider-specific failures.

Each provider section separates how the provider works from what Lunar Paper currently supports. That matters when a provider offers authentication modes, endpoints, or object models the current DataHub connector does not yet expose.

Before you connect

Confirm that you have:

• permission to read the source data
• a provider credential created for this connection
• the network details, database, schema, or document identifiers the provider requires
• access to the DataHub module in the destination service

Use a dedicated account or token with the fewest privileges the provider allows. Never put credentials in comments, screenshots, task descriptions, or anywhere else people can read them. If a credential is exposed, rotate it straight away.

Add a connection

1. Open the service that will use the data.
2. Open DataHub.
3. Select Add Connection.
4. Choose a cloud database or external API provider.
5. Complete the provider fields described below.
6. Select Test Connection.
7. Preview the available data and confirm that the expected tables or databases appear.
8. Save the connection.

For PostgreSQL-compatible providers, paste the complete connection string when one is available. DataHub fills the host, port, database, username, password, schema, and SSL settings from strings such as:

postgresql://user:password@host:5432/database?sslmode=require

Check every field it fills in before you test. A valid connection string can still point to the wrong branch, database, or schema.

Neon

How third-party integrations connect

Neon exposes each branch through a standard PostgreSQL connection string. Its Connect dialog can provide a direct endpoint or a pooled endpoint whose hostname includes -pooler. Neon recommends pooled connections for applications that open many connections at once. Direct connections are still useful when a client needs PostgreSQL session behavior that PgBouncer does not support. Both connection types require TLS through sslmode=require.

See Neon’s official guidance for connecting an application and choosing a pooled connection.

How Lunar Paper connects

Lunar Paper treats Neon as PostgreSQL. Paste either Neon connection string into the DataHub wizard and Lunar Paper separates it into host, port, database, role, password, schema, and SSL fields. DataHub then tests the database connection, scans the selected schema, and lists the tables it finds so you can preview them.

Use the pooled string for routine shared DataHub workloads. Use the direct string if your Neon connection reports an unsupported PgBouncer startup parameter.

Field	Value
Host	Copy the ep-...<region>.aws.neon.tech host from the project’s Connection Details panel.
Port	5432
Database	Usually neondb
Username	Copy the role shown in Connection Details, such as neondb_owner.
Password	Use the database password shown when the connection string is generated.
Schema	Select the schema that contains the required tables. It may not be public.
SSL	Required

Neon branches are separate databases with separate hosts and connection strings. If the connection succeeds but the wrong data appears, return to Neon, select the intended branch, and copy its connection string again.

If tables are missing after correcting the schema, close and reopen the connection to request a fresh table scan.

Supabase Cloud

How third-party integrations connect

Supabase offers direct PostgreSQL, shared-pooler session, and shared-pooler transaction connections. Direct connections use IPv6 unless the project has the IPv4 add-on. Supavisor session mode uses port 5432 and is intended for persistent application clients on IPv4 networks. Transaction mode uses port 6543, is intended for short-lived or serverless traffic, and does not support prepared statements.

See Supabase’s official connection-method comparison and network restriction guidance.

How Lunar Paper connects

Lunar Paper uses the PostgreSQL connector rather than the Supabase browser SDK or Data API. Paste the connection string from the Supabase Connect panel and DataHub extracts the database fields, tests SQL access, scans the schema, and previews tables.

If your Lunar Paper server runs normally on an IPv4 network, start with the shared pooler’s session mode on port 5432. Use transaction mode on 6543 only when your deployment uses short-lived connections and its query path does not need prepared statements.

Field	Value
Host	Use aws-0-<region>.pooler.supabase.com from Project Settings > Database > Connection pooling.
Port	5432 for the shared session pooler, or 6543 for transaction mode.
Database	postgres
Username	Use postgres.<project-ref>, including the project reference.
Password	Use the database password, not the Supabase account password.
SSL	Required

Avoid the direct db.<project-ref>.supabase.co host on networks without outbound IPv6. If a correct-looking connection fails with a DNS or ENOTFOUND error, replace the direct host with the IPv4-compatible pooler host. Check as well that the project reference is appended to the username.

Databricks SQL

How third-party integrations connect

Databricks SQL clients connect to a running SQL Warehouse or compatible compute resource with three independent values: Server Hostname, HTTP Path, and an authentication credential. The official Node.js driver supports personal access tokens as well as OAuth machine-to-machine and user-to-machine authentication. Databricks recommends keeping those values in secure configuration instead of application code.

See the official Databricks SQL Driver for Node.js documentation.

How Lunar Paper connects

Lunar Paper uses the Databricks SQL driver and currently offers personal access token authentication. Pasting a workspace or Data Explorer URL fills in the host, catalog, and schema, but the URL cannot carry the warehouse HTTP path or the token. DataHub uses the warehouse to test connectivity, find the objects you are allowed to see, and run previews inside the optional catalog and schema boundary.

Databricks itself supports OAuth M2M and U2M, but the Lunar Paper wizard cannot currently configure them. If workspace policy disables personal access tokens, ask an administrator for an approved authentication path rather than working around the policy.

Field	Value
Workspace Hostname	Copy the hostname from the workspace URL, such as dbc-....cloud.databricks.com or adb-....azuredatabricks.net.
SQL Warehouse HTTP Path	Open SQL Warehouses, select the warehouse, open Connection details, and copy the complete /sql/1.0/warehouses/<id> value.
Personal Access Token	In user settings, open Developer > Access tokens and generate a token.
Catalog	Optional. Set it to limit browsing to one Unity Catalog catalog.
Schema	Optional. Set it to limit browsing to one schema.

You can paste a Data Explorer URL or workspace hostname to fill in the host, catalog, and schema. You still have to enter the warehouse HTTP path and token separately.

If testing returns 400 Bad Request, remove any whitespace or newline from the token and confirm that the SQL Warehouse is running. If the host does not resolve, copy the complete server hostname and HTTP path from Connection details rather than using the standalone Warehouse ID.

Snowflake

How third-party integrations connect

Snowflake drivers require an account endpoint plus authentication. Snowflake’s Node.js driver supports passwords, MFA, browser or Okta SSO, key-pair JWT, OAuth, programmatic access tokens, and workload identity. You can identify the account with an account identifier, and the driver’s accessUrl option accepts a complete https://...snowflakecomputing.com endpoint.

See Snowflake’s official guidance for account identifiers, Node.js connection options, and authentication methods.

How Lunar Paper connects

Lunar Paper currently maps the wizard’s Account URL to Snowflake’s full access endpoint, falling back to Account Locator when no URL is supplied. It then applies the warehouse, database, role, username, and password while discovering schemas and previewing rows.

The current wizard documents username-and-password authentication only. If the Snowflake account requires browser SSO, key-pair authentication, OAuth, workload identity, or an MFA flow that cannot be completed without a person present, ask the Snowflake administrator for a policy-approved service connection. What the provider supports is not always what the Lunar Paper connector supports.

First work out whether the account uses an organisation-based URL or a classic account locator.

Field	Value
Account URL	For organisation-based accounts, use https://<org>-<account_name>.snowflakecomputing.com. Obtain the exact names with SELECT CURRENT_ORGANIZATION_NAME(), CURRENT_ACCOUNT_NAME();.
Account Locator	For classic accounts only, combine the account and region returned by SELECT CURRENT_ACCOUNT(), CURRENT_REGION(); as <account>.<region>.
Warehouse	Use the active warehouse shown in Snowsight or returned by SELECT CURRENT_WAREHOUSE();.
Database	Enter the database containing the required data.
Username and Password	Use the Snowflake login assigned to the connection.
Role	Optional. Use the active role or a role granted access to the warehouse and data.

For newer organisation-based accounts, complete Account URL and leave Account Locator blank. Do not enter app.snowflake.com, because that is the web interface, not the database endpoint.

Snowflake normally stores unquoted object names in uppercase. If access is denied, confirm that the selected role can use the warehouse and read the database and schema. When creating test data in Snowsight, remember that each worksheet tab has an independent session: run USE DATABASE ...; and USE SCHEMA ...; in every tab that needs that context.

Airtable

How third-party integrations connect

Airtable’s Web API uses bearer credentials. Personal access tokens are restricted both by scopes and by selected base or workspace resources, so a valid token can still fail to discover a base or read its records. Third-party tools use the Metadata API to list tables and the records API to page through their rows.

See Airtable’s official Web API authentication and API overview.

How Lunar Paper connects

Lunar Paper normalises a full Airtable browser URL, API URL, or base ID into the base endpoint. It uses schema.bases:read to build the checkbox list in Select Airtable Tables, then uses data.records:read to preview and sync the selected tables. DataHub handles Airtable’s opaque offset cursor for you as it requests later pages of records.

Saving starts a best-effort initial sync into DataHub’s local copy. The DataHub overview queries that copy rather than calling Airtable on every view, so use Refresh Now if the initial sync does not finish.

Field	Value
Base URL	Paste a full Airtable browser URL, an api.airtable.com/v0/app... URL, or the app... base ID.
Token	Create a personal access token at Developer Hub > Personal access tokens and scope it to the base.

Grant both schema.bases:read for table discovery and data.records:read for row access. A 401 while selecting tables usually means the token is missing the schema scope or does not have access to that base.

After saving, allow the initial sync to finish. If the connection stays at Never synced or shows no rows, select Refresh Now. Tables created by CSV import may keep names such as “Imported table”. Those names come from Airtable.

Coda

How third-party integrations connect

Coda’s REST API uses https://coda.io/apis/v1 with a bearer API token. The token inherits the Coda user’s access. Use stable resource IDs rather than names, because users can rename docs and tables. List endpoints use opaque nextPageToken pagination. Coda may return slightly stale snapshots, enforces per-user rate limits, and returns 429 when callers need to back off.

See the official Coda API reference, including its authentication, pagination, consistency, and rate-limit behavior.

How Lunar Paper connects

Lunar Paper extracts the document ID from a Coda browser or API URL, authenticates with the supplied token, and discovers the document’s tables. Each table you choose becomes a DataHub dataset. DataHub fetches its rows across Coda’s page tokens and stores them locally for querying.

Coda’s API can lag a browser edit by a few seconds, so wait a moment before treating a missing edit as a failed Lunar Paper sync. Use Refresh Now to request a new local snapshot. Repeated 429 responses mean that activity using the same Coda user token has reached Coda’s shared per-user limit.

Field	Value
Base URL	Paste the full Coda document URL or a coda.io/apis/v1/docs/<docId> API URL.
Token	In Coda account settings, open API settings and create a token that can access the document.

Test the connection, select the required tables, preview the returned rows, and save. If no tables appear, check that the token’s account can open the document the URL points to.

Notion

How third-party integrations connect

Notion connections use a bearer token, an explicit Notion-Version header, declared capabilities, and content access granted to the connection. An internal connection cannot read a page just because the page sits in the same workspace. You have to add the page through the connection’s content access or Add connections flow. A read-only export needs only the Read content capability, and writing back also needs the relevant insert or update capabilities.

Notion’s current API models a database as a container of one or more data sources. Current integrations search for data_source objects and query /v1/data_sources/{data_source_id}/query. See Notion’s official authorization guide, capability reference, and multi-source database upgrade guide.

How Lunar Paper connects

Lunar Paper’s current connector uses Notion’s legacy 2022-06-28 database model. It searches for shared database objects, substitutes each real database ID into /databases/{databaseId}/query, sends the query as POST, and follows body-based start_cursor pagination. It then normalises nested Notion properties into scalar DataHub columns and stores the results locally.

This legacy mode works for conventional single-source Notion databases. It is not the same as Notion’s current data_sources API, so do not treat it as full support for multi-source databases. If a database gains a second data source, discovery or querying may fail or leave it out until Lunar Paper’s connector is upgraded. Leave the version header below as it is rather than entering Notion’s latest version by hand.

Field	Value
Base URL	https://api.notion.com/v1
Auth Type	Bearer Token
Token	Use the integration’s Internal Integration Secret from My integrations.
Additional Headers	{"Notion-Version": "2022-06-28"} for Lunar Paper’s current legacy connector

Before discovery, open each Notion database, select the ... menu, open Connections, and add the integration. A Notion integration has no access until you share content with it.

1. Configure authentication and select Test Connection.
2. Continue to Select Notion Databases.
3. Select each database that DataHub should sync.
4. Preview each selected database.
5. Save the connection and allow the initial sync to finish.

If discovery reports that no databases were found, the token may be valid while no database has been shared with the integration. Check as well that the target is a conventional single-source database. If authentication returns 401 or 403, check the integration secret, connection capabilities, content access, and stray spaces. An error on the bare Notion API URL that is not an authentication error does not necessarily mean the token is invalid. Use database discovery and preview to confirm data access.

Verify the connection

After saving any provider:

1. Confirm that the connection reports an online or successful state.
2. Open the discovered table or dataset list.
3. Preview at least one dataset and compare its columns and sample rows with the source.
4. Confirm that the connection points to the intended production, staging, or branch environment.
5. For API-backed providers, confirm that the first sync completes and that refreshed data is queryable.

Troubleshooting checklist

Work through these checks in order:

1. Credential: Re-enter or rotate the password or token. Remove leading and trailing whitespace.
2. Endpoint: Copy the host, account URL, base URL, or HTTP path directly from the provider.
3. Network: Prefer the Supabase pooler when IPv6 is unavailable and confirm that firewalls allow outbound access.
4. Scope: Check the database, schema, branch, catalog, base, document, or shared Notion database.
5. Permissions: Confirm that the account can use the compute resource and read the selected data.
6. Provider state: Start suspended compute such as a Databricks SQL Warehouse.
7. Refresh: Reopen a database connection or use Refresh Now for an API-backed connection after changing its configuration.

When you edit an existing connection, secret fields may appear masked or redacted. Leave an unchanged secret in place, and replace it only when you rotate the credential. Test and preview the connection again before saving your changes.