> ## Documentation Index
> Fetch the complete documentation index at: https://docs.platinur.com/llms.txt
> Use this file to discover all available pages before exploring further.

# MySQL

> Prepare a secure, read-only MySQL connection for Platinur.

MySQL is a native Platinur v1 source. Platinur discovers the tables visible to the configured user
and loads the tables you select into a dedicated `raw_` ClickHouse database.

## Before you connect

Prepare:

* a publicly reachable MySQL hostname;
* port `3306`, unless your provider uses another TLS endpoint;
* the database name;
* a dedicated read-only username and password; and
* a server certificate trusted by the standard CA bundle and valid for the hostname.

Platinur requires encrypted MySQL sessions and verifies both the certificate and server identity.
It does not expose SSH tunnel fields in v1.

## Create a read-only user

Create a dedicated account and limit it to the database Platinur should load:

```sql theme={null}
create user 'platinur_reader'@'%' identified by '<generate-a-strong-password>' require ssl;
grant select, show view on app_database.* to 'platinur_reader'@'%';
```

Restrict the account's allowed host further when your provider supports an IP-specific user or
network allowlist.

## Network access

Allow inbound MySQL TLS connections from the Platinur host address provided by support or your
workspace administrator. Use the provider's certificate-backed hostname rather than an IP address
or private service name.

Copy the public **host**, **port**, and **database** from your provider's connection-details page.
Enter those values separately in Platinur rather than pasting a full connection URL.

## Connect in Platinur

1. Open **Integrations → New Source → MySQL**.
2. Enter a source name and target schema suffix.
3. Enter the host, port, database, username, and password.
4. Test the connection, then save it.
5. Open **Schema**, discover the database, and choose the tables to load.

Paste the copied values into **Host**, **Port**, and **Database**, then enter
**Username** (`platinur_reader`) and its password. **Test Connection** validates the TLS session
and read access before saving. After saving, discover the tables in **Schema** and run **Sync**.

The verified connection used by the test is also used by discovery and every sync.

## Refresh behavior

Database tables support Override, Append, and Merge when the selected table has the required
cursor or primary-key contract. Start with Override unless you have confirmed the incremental
columns. You can run the source manually or configure a schedule.

## Troubleshooting

* **Host or port unreachable:** confirm the hostname, firewall, allowlist, and TLS port.
* **TLS handshake failed:** verify that the provider enables TLS and presents a certificate for
  the hostname you entered.
* **Authentication failed:** confirm the username's allowed host and rotate the stored password.
* **No tables discovered:** grant `SELECT` and `SHOW VIEW` on the intended database.
* **Access denied during sync:** confirm the user still has access to every selected table.

## Rotate or revoke access

Change the dedicated user's password, replace it in the source's **Config** tab, and use
**Test Connection** before retiring the old password. To remove Platinur immediately, disable the
source and run `drop user 'platinur_reader'@'%';` (or revoke its grants). The stored secret is not
shown again by Platinur.

## Official MySQL references

* [CREATE USER](https://dev.mysql.com/doc/refman/8.4/en/create-user.html)
* [GRANT statement](https://dev.mysql.com/doc/refman/8.4/en/grant.html)
* [Using encrypted connections](https://dev.mysql.com/doc/refman/8.4/en/using-encrypted-connections.html)