Connection problems and what they mean

The validation errors VaultKeep shows for a Supabase connection string, and how to fix each one.

After you connect a project or rotate its credentials, the job runner validates them and the project shows active or error with the reason. These are the messages you may see.

Message	Cause	Fix
The connection string uses port 6543 (transaction pooler)	Supabase's transaction-mode pooler can't hold the prepared statements `pg_dump` needs	In Project Settings → Database, copy the session pooler or direct connection string (port 5432)
Password authentication failed	Wrong or URL-encoded password	Copy the string again including the password. If your password contains `@`, `#` or `/`, URL-encode it
Tenant or user not found	Pooler host with the plain `postgres` user	When using the pooler host, the username must be `postgres.<project-ref>`
The host could not be resolved	Typo in the host	Re-copy the connection string
Connection refused	Wrong port, or the project is paused	Use 5432; unpause the project in the Supabase dashboard
Timed out connecting	Project paused, or network restrictions on the project	Unpause, or allow connections from the internet (VaultKeep's runner has no fixed IP)
The server rejected the connection: no pg_hba.conf entry / SSL	TLS required	Append `?sslmode=require` to the connection string
Database OK, but the Storage S3 keys were rejected	Wrong or revoked keys	Create new keys under Storage → S3 access keys, or remove the keys from the project

Re-validating

Open the project → Credentials, paste the new connection string and click Update & validate. The old secret is destroyed the moment the new one is stored, and the project re-validates within a minute.

Size cap

A backup can also fail with "Database is X GB, above the Y cap of the plan". That is a plan limit, not a connection problem; see the plan table.

Still stuck? Email support@vaultkeep.dev with your project name (never your connection string) and we'll take a look.