Dashboard Tour

Think of the AxiomDB console as your main control center for managing your database infrastructure—no SSH required! Everything you can do using the CLI or the API is also available right here in the web browser. Plus, the console gives you visual tools like schema relationship diagrams, easy-to-read monitoring graphs, and backup timelines to make your life easier. Let's take a tour!

Projects

Your journey starts on the Projects page. Here, you'll see a list of every project owned by your organization or shared with you.

What the project list shows

For each project, we display a few key details:

Creating a new project

Whenever you need to spin up a new project, just click the New Project button to open the form:

1. Name — Choose a descriptive name for your workspace (for example, "Square Experience").
2. App Key — Type a lowercase, alphanumeric slug that will be used in your database names (like square_experience).
3. Environment — Pick the right label for your setup: main, dev, staging, or prod.

Once you submit the form, you'll see a progress indicator showing you what's happening while our gateway:

1. Creates the project metadata in the background.
2. Spins up your protected main database branch.
3. Sets up the Postgres database and roles.
4. Generates secure connection credentials.
5. Sets up your default network security settings.

As soon as everything is ready, you'll be taken straight into your new project workspace!

Diving into a project workspace

Clicking on any project name opens its workspace, where you'll find these tabs:

• Branches — Create, delete, and manage your database branches.
• Tables — Browse your schema, inspect tables, and look at your data.
• Network — Manage your IP allowlists and select your network access modes.
• Backups — Take manual snapshots or restore data from backups.
• Monitoring — Watch database health and performance metrics in real-time.
• Audit — Look through security logs and see who did what.
• Settings — Set project-wide cleanups and access policies.
• Team — Invite your teammates and manage their roles.

Deleting a project

If you ever need to delete a project, keep in mind that:

1. You must be the project owner.
2. You'll need to type out the project name to confirm.
3. There shouldn't be any active database restore jobs running.
4. We highly recommend making a fresh backup first, just in case!

Deleting a project will remove all database branches, roles, passwords, network rules, API tokens, and settings. However, we'll keep the project-level audit logs around for security and accountability.

Branches

Branches are the actual databases you'll connect your apps to. To keep things clean, every single branch is isolated and has its own credentials, metrics, lifespan, and audit logs.

Understanding the branch list

Under the Branches tab, you'll see:

Spin up a new branch

Ready to test a new feature? Click New Branch to fill out the details:

1. Name — Give it a clear name (like feature-auth or release-may).
2. Source Branch — Pick the parent branch you want to clone the schema from.
3. Lifespan — Choose how long you want this branch to stay active before we clean it up.

Once you click create, AxiomDB will:

• Spin up a new database named sq_<app_key>_<env>_br_<branch_slug>.
• Generate fresh database roles (owner, runtime, and readonly).
• Create unique, secure credentials.
• Copy your schema over from the parent branch using pg_dump and pg_restore.
• Inherit the network allowlists you set for the project.

Connecting to your branch

Click Connect on any branch to open up the credentials modal. Here, you'll find:

• DATABASE_URL — Your main connection string for app traffic (port 6432, pooled).
• DIRECT_URL — The direct migration connection string for running schema updates (port 5432).
• Framework snippets — Handy copy-paste code blocks for Prisma, Drizzle, Kysely, node-postgres, SQLAlchemy, Django, Laravel, Go pgx, and Rust SQLx.
• Copy buttons — Copy any URL or snippet with a single click.

Note: For security reasons, every time someone views these credentials, we log it as a branch.credentials.viewed event.

Rotating credentials

If you ever need to rotate your passwords, just click the Rotate button. You can choose to update:

Credential rotation is atomic, meaning we'll generate the new password, update PostgreSQL and PgBouncer, refresh the secure credentials file, and show you the new URLs.

Deleting a branch

To clean up an old or unused branch, click Delete (make sure it isn't protected). You'll just need to:

1. Type the branch name to confirm you want to delete it.
2. Make sure there are no restore operations currently running on it.

A hard delete will permanently remove:

• The branch database.
• All roles associated with the branch (owner, runtime, readonly).
• PgBouncer configuration entries.
• Saved credentials.
• Any network rules set specifically for this branch.
• Branch metadata (though we keep the audit logs intact).

Remember, you cannot delete protected branches (like main) unless you delete the entire project.

Tables

The Tables tab lets you inspect your live database structure and browse through your data.

Navigating the Table Explorer

The explorer is split into three easy-to-use panels:

1. Model list (on the left) — A list of all tables in the current branch, grouped by their database schema.
2. Column inspector (at the top) — Details about columns, data types, nullability, default values, indexes, and foreign keys.
3. Row browser (at the bottom) — A paginated view of your table's data, showing 50 rows at a time.

Schema Flow (Visual Schema Map)

Want to see how your tables relate? The Schema Flow view renders your tables as draggable nodes and connects them with lines representing foreign key relationships.

Here is what you can do:

• Auto-layout — The console automatically organizes your tables into a clean layout based on relationships.
• Drag and drop — Move tables around to customize your view.
• Align — Click this to reset any tables you've moved back to the default layout.
• Relationship lines — Easily trace how data links from one table to another.
• Clean naming — Nodes display clean names like Invoice rather than technical DB names like public.Invoice.

Editing data directly

If your user role has permission (owner, admin, or developer), you can edit data directly in the browser:

1. Click on any row to open the editor panel.
2. Change the values you need to update.
3. Click Save to apply the updates safely.

Under the hood, we use parameterized SQL queries to prevent SQL injection, and all manual database edits are recorded in the audit logs.

What if my database is empty?

If you haven't run any migrations or created any tables yet, you'll see a friendly message:

No tables yet
Run your first migration or create a table from the SQL editor.

Network

The Network tab is the primary security gatekeeper for your databases. It controls exactly who (and what) can talk to PostgreSQL.

Understanding Access Modes

You can set your project's network security to one of three modes:

Allowlisting your current device

To quickly let your own machine connect, follow these steps:

1. Click the My IP button—the gateway will auto-detect your current public IP address.
2. Take a look at the generated CIDR rule (usually a /32 rule for single devices).
3. Click Save JSON—we'll immediately apply this rule to Postgres, PgBouncer, and your firewall (UFW).
4. Go ahead and test your database connection!

Managing your network rules

The rules table shows you all active permissions:

Setting up CI/CD rules

If you are setting up deployment pipelines (like GitHub Actions), you'll want to add a permanent rule with a wider CIDR block:

{
  "cidr": "10.0.0.0/8",
  "label": "CI/CD Pipeline",
  "ports": "both",
  "scope": "project",
  "expires_in": "permanent"
}

Changing your Access Mode

If you're running serverless or edge deployments where IP addresses change frequently, you might want to open up your runtime port:

1. Click Change Mode.
2. Select public_runtime.
3. Type the confirmation text.
4. Click Confirm.

This leaves your migration port (5432) securely locked down under your IP allowlist, while letting serverless functions connect to your pooled runtime port (6432) from anywhere on the web.

Backups

The Backups tab is your safety net, giving you tools to capture snapshots and recover your data.

The Backup Timeline

Here you'll see a complete list of all automated and manual backups:

Creating a manual snapshot

Before making major changes, it's a great idea to click Create Snapshot to save a restore point:

1. Name — Give it a clear name (for example, pre-migration-2026-05-08).
2. Branch — Choose the database branch you want to back up.

Tip: We highly recommend taking a snapshot before running destructive migrations, deleting branches, cleaning up data, or launching major updates!

How to restore your data

If you ever need to roll back to a backup, click Restore and follow the flow:

1. Select backup — Choose the backup file or point-in-time state you want to recover.
2. Choose target — We recommend restoring your data into a new branch (e.g., restore-2026-05-08) rather than overwriting your active branch.
3. Confirm — Type the confirmation text to make sure everything is correct.
4. Monitor — Keep track of the restore job's progress under the Jobs tab.

Your restore checklist

□ Select snapshot or point-in-time target
□ Choose restore target branch (prefer new branch)
□ Confirm source and target database names
□ Start restore job
□ Track job status in the Jobs page
□ Validate schema and row counts on the target branch
□ Rotate credentials if the restore exposes old secrets
□ Swap application traffic to the restored branch
□ Clean up the old branch if no longer needed

Monitoring

The Monitoring tab gives you a real-time view of your database's health, performance, and overall workload.

Checking branch-specific metrics

For any active database branch, you can monitor:

Monitoring your server health (Host Metrics)

Separate from individual database metrics, you can check the general health of your hosting VPS:

Live metrics stream

The console can stream live metric updates straight to your screen using Server-Sent Events (SSE). You'll see:

• Connection counts update in real-time.
• Storage changes as data is written.
• Estimated compute load adjustments.

Audit Logs

The Audit tab is your security log, tracking every sensitive action taken in your project.

What an audit log looks like

Every audit event is saved with detailed metadata:

{
  "actor_id": "user_123",
  "action": "branch.credentials.viewed",
  "target_type": "branch",
  "target_id": "br_456",
  "ip": "203.0.113.10",
  "user_agent": "Mozilla/5.0",
  "metadata": {},
  "created_at": "2026-05-08T09:00:00Z"
}

Events we track

Here is a list of activities that write to the audit log:

Filtering your logs

You can easily filter the log list by:

• Actor — The user who performed the action.
• Action — The specific activity (like credential reveals or deletions).
• Target — The project or branch that was affected.
• Date range — The timeframe you want to search.

Settings

The Settings tab is where you configure project-wide policies and defaults.

Branch Cleanup Policies

Keep your workspace tidy by configuring automated cleanups for temporary branches:

• Auto-delete expired branches — Let AxiomDB automatically delete branches that have passed their expiration date.
• Grace period — How long we wait after expiration before deleting (defaults to 24 hours).
• Notify before cleanup — Send out an email alert before a branch is deleted.

CORS and Data API Settings

Configure web-based API access:

• Allowed origins — Specify which domain names can make cross-origin requests to your database API.
• Methods — Choose which HTTP methods are allowed (such as GET, POST, PATCH, or DELETE).
• Credentials — Toggle whether CORS requests can include cookies or auth headers.

Credential Reveal Policies

Control who has access to view database passwords:

• Default — Only project owners and admins can view database connection URLs.
• Allow developers — Give developers permission to view credentials too.
• Viewer override — Grant credentials access to specific viewer accounts.

No matter what settings you choose, every single credential reveal is logged in the Audit tab!