---
title: Connections
description: Connect a service to PostgreSQL, Redis or a bucket, and the variables each connection sets.
section: Data
order: 1
---

A connection gives one service its own credentials for one database or bucket, delivered as environment variables. To make one, drag from the service's right edge to the database or bucket on the canvas.

## What does connecting do?

1. Checks that both are in the same environment and that your role allows the change.
2. Records the connection and asks the infrastructure engine for credentials that belong only to this service.
3. Encrypts the credentials into the service's variables.
4. Restarts the service so it picks them up.

The line on the canvas is dashed while this happens and turns solid once the restart succeeds. If a step fails, the line shows the error and a **Retry** button, and nothing is left half-applied.

## Which variables does a connection set?

| Connected to | Variables |
| --- | --- |
| PostgreSQL | `DATABASE_URL` |
| Redis | `REDIS_URL` |
| Object storage | `S3_ENDPOINT`, `S3_BUCKET`, `S3_ACCESS_KEY_ID`, `S3_SECRET_ACCESS_KEY` |
| [Queue](/docs/queues) | `QUEUE_URL` |

`DATABASE_URL`, `REDIS_URL`, `QUEUE_URL` and the two S3 keys are secret. All of them are marked **Connection** on the **Environment** tab and can't be edited there. If the service already has a variable of its own with one of these names, Dekka refuses the connection with 409 `env_key_conflict`, so remove or rename it first.

## What can connect to what?

Web services, workers and cron jobs can each connect to PostgreSQL, Redis, object storage and queues in the same environment. Two services connected to the same database each get their own credentials, and databases and buckets never connect to each other.

## Connect with the API

```bash tab="cURL"
curl https://api.dekka.cloud/v1/projects/$PROJECT_ID/connections \
  -H "Authorization: Bearer $DEKKA_API_KEY" \
  --json '{ "source_id": "'$SERVICE_ID'", "target_id": "'$DATABASE_ID'" }'
```

The response lists the connection's `bindings` and its `status`, which moves from `pending` to `active`, or to `failed` with the reason. `POST /v1/connections/{id}/retry` tries a failed connection again.

## Disconnect a service

Select either end on the canvas, find the connection under **Connections** and choose **Disconnect**. Dekka removes the credentials and the variables once the engine confirms. A database or bucket with connections can't be deleted until you disconnect them.