仙kisenon

Connection strings

Format, TLS, role and password rules for Kisenon endpoints.

Every Kisenon endpoint exposes a standard postgresql:// URI:

postgresql://<role>:<pwd>@<endpoint_id>.<region>.kisenon.com:5432/<database>?sslmode=require

Components

FieldMeaning
<role>A Postgres role created on the branch. The endpoint card shows the auto-created app role; you can create more via SQL.
<pwd>The role's password. Surfaced once at creation; rotate via SQL.
<endpoint_id>Stable per endpoint, e.g. ep_4f3c12a9b8e6. SNI-routed.
<region>Your project's region slug — usc1 today (US Central, GCP). Derived, not hardcoded; see Regions.
kisenon.comThe data-plane apex. Routes via TLS SNI to your endpoint.
5432Standard Postgres port.
<database>Default main; create more with CREATE DATABASE.
?sslmode=requireTLS is mandatory. verify-full also works and is recommended.

TLS

Endpoints terminate TLS with a Let's Encrypt certificate for *.<region>.kisenon.com. Standard Postgres clients verify against the system trust store; no custom CA needed.

sslmode=verify-full is recommended for production code. It checks the certificate chain and the hostname.

How the proxy routes to your endpoint

The data-plane proxy decides which endpoint a connection belongs to from two signals, in order:

  1. The neon.endpoint_id startup option, if the client sends one.
  2. The TLS SNI hostname (<endpoint_id>.<region>.kisenon.com) as a fallback.

The username field is not consulted for routing — pick any role your branch defines. Console-generated connection strings carry the endpoint in the hostname, so they route via SNI automatically and you don't need to set anything extra.

Pass neon.endpoint_id explicitly only when your client can't present the endpoint in SNI — for example a TLS stack that won't send a Server Name extension, or a tunnel that rewrites the host. Most Postgres drivers send SNI by default, so this is rarely needed.

Connection pooling

Pooling is GA and on by default — every endpoint has a pooled host alongside its direct one (since 2026-07-18).

The pooled host is <endpoint_id>-pooler.<region>.kisenon.com — the same endpoint, with -pooler inserted into the host label — on port 5432 with sslmode=require:

postgresql://<role>:<pwd>@<endpoint_id>-pooler.<region>.kisenon.com:5432/<database>?sslmode=require

The console Connect panel and the API response both hand you a connection_uri_pooled alongside the direct connection_uri.

The pooler runs in transaction pooling mode (a PgBouncer sidecar per compute). That's ideal for many short-lived connections — serverless functions, edge runtimes, agents — where each transaction can borrow a server connection and return it immediately.

Use the direct (unpooled :5432) connection instead when you need:

  • LISTEN / NOTIFY.
  • Session-level advisory locks.
  • Session SET / GUCs that must outlive a single transaction.
  • Server-side prepared statements.

The direct connection_uri is always available and is never removed, so these keep working exactly as before. A client-side pool (PgBouncer or your driver's built-in pool) in front of the direct connection also remains valid.

Opt an endpoint out of pooling with the pooler_enabled: false field at create time or via PATCH /v1/endpoints/{endpointId}. The default is true.

Multiple endpoints

You can spawn multiple endpoints on the same branch. They share storage but have independent connection limits and caches. Use them to isolate:

  • App vs analytics traffic.
  • Read replicas (any endpoint on a branch is essentially a read replica if you don't write to it).
  • Per-environment endpoints on dev branches.

Concepts

Branches, endpoints, scale-to-zero — the model behind Kisenon.

Serverless / edge driver

Use the unmodified @neondatabase/serverless driver against Kisenon over HTTP and WebSocket.

On this page

ComponentsTLSHow the proxy routes to your endpointConnection poolingMultiple endpoints