Skip to main content
One field carries the whole setup: the instance connection name, project:region:instance, which is on the instance’s overview page in the Google Cloud console. The proxy itself runs as a child process, started on connect and killed on disconnect.
Instance connection name, authentication and local listener fieldsInstance connection name, authentication and local listener fields

Cloud SQL Auth Proxy selected on the Network tab

​
Before you start

The pane appears for Cloud SQL instances running MySQL, PostgreSQL, or SQL Server. The account you connect with needs the Cloud SQL Client role (roles/cloudsql.client) on the project, and for Application Default Credentials, one run of:
Install the binary, or click Download cloud-sql-proxy… in the pane, which fetches 2.23.0 and checks its SHA-256 against the value pinned for your CPU architecture.
Auto-detection covers your PATH, /opt/homebrew/bin, /usr/local/bin, and ~/google-cloud-sdk/bin. Anywhere else, use Choose….

​
Setting up

1

Enable the pane

On the Network tab, set Connect via to Cloud SQL Auth Proxy. A connection uses one transport, so choosing this one switches off whichever was selected before.
2

Name the instance and pick credentials

Enter the Instance connection name, then choose Application Default Credentials or Service Account Key.
3

Leave the SSL pane alone

The proxy encrypts the leg to Cloud SQL and hands the driver plain loopback, so SSL/TLS stays off.
4

Test it

On General, click Test Connection. Host and Port there are never dialed: the instance connection name decides where the proxy lands. Username and Database work as usual.

​
Options

A pasted key is kept in the macOS Keychain and written to a temporary file readable only by you while the proxy runs, then deleted. It never reaches the command line.
GOOGLE_APPLICATION_CREDENTIALS works too, but the proxy inherits the app’s environment, and a GUI app never sees variables exported by your shell profile.
TablePro polls that port and gives 30 seconds to answer on it. Past that the connect fails and the error carries the last lines printed, which is where the real reason usually is.

​
Troubleshooting

​
cloud-sql-proxy was not found

Install it with brew install cloud-sql-proxy, download it from the pane, or set Path.

​
The proxy did not become ready in time

Run it by hand to see what it says:

​
Permission or authentication errors

The proxy reports these on its own output, which the failed connect shows. Usually the account is missing the Cloud SQL Client role, Application Default Credentials were never set up, or IAM database authentication is on with no database user for the principal.