> ## Documentation Index
> Fetch the complete documentation index at: https://ngquct-docs-fix-500-query-results.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.
# Connection Sharing
> Export connections to a file, share links, import from other apps, and resolve passwords from secret managers
Passwords stay in your Keychain, so every route here hands over a connection definition and leaves the other person to supply their own credential. An encrypted export is the one exception.
| Route | Use it when | Passwords | Needs |
| --------------------------------------------------------------- | ------------------------------------------ | --------------------------------- | ------- |
| `.tablepro` file | One-off, any number of connections | Only with **Include Credentials** | Nothing |
| `tablepro://` link | One connection, pasted into a chat | Never | Nothing |
| [Linked Folder](#linked-folders) | A shared set has to stay current | Never | Starter |
| [Team Catalog](#team-catalog) | Your team already shares a repo or a drive | Never | Team |
| [Team Library](/features/team#share-connections-with-your-team) | Your team shares nothing on disk | Never | Team |
| [iCloud Sync](/features/icloud-sync) | Your own second Mac, not a colleague | Optional | Starter |
## Export
Right-click a connection > **Share > Export to File…**, selecting several first to export them together, or **File > Export > Export Connections…** for all of them.
The file carries what the connection form holds, from host and port through SSH and SSL configuration, color, tags, group, Safe Mode level, startup commands, AI policy, the Local only flag, and any driver field the plugin does not mark secret. Passwords, key passphrases, TOTP secrets, and secret driver fields stay behind.
**Copy Connection String** writes a database URL that carries the password in plain text, plus the SSH password when the connection tunnels. TablePro marks the clipboard item concealed, which keeps it out of the history of clipboard managers that follow that convention and out of nothing else. **Copy TablePro Link** and **Copy as JSON** carry no secrets.
### Encrypted export
Needs a [Starter license](/features/licensing).
Turn on **Include Credentials** in the export sheet and enter a passphrase of 8 characters or more. Credentials go out under AES-256-GCM, keyed from the passphrase with PBKDF2 at 600,000 iterations. Importing asks for the passphrase.
## Import
Open a `.tablepro` file through **File > Import > Import Connections…**, by right-clicking the empty area of the connection list, by double-clicking the file, or by dragging it onto TablePro. **File > Import > Import from URL…** takes a database URL instead, described in [Connection URLs](/connections/urls).
A preview badges each connection before anything is saved: a green checkmark for ready, a yellow triangle when an SSH key or certificate is missing, a "duplicate" tag for one that already exists. Duplicates match by host, port, database, and username and start unchecked. Check one, then pick **As Copy**, **Replace**, or **Skip**.
Anything that decides where a credential comes from is stripped on the way in, from a file and from a link alike: AWS options including IAM authentication, the region, the profile and the RDS endpoint; **Use Password File**; **Prompt for password**; the SSL client key passphrase; the pre-tunnel host and port; and the **Pre-Connect Script**. Startup SQL does arrive, and the confirmation sheet shows it in full. Read it before you save, because it runs on every connect with your credentials.
## Share via link
**Share > Copy TablePro Link** produces a `tablepro://import?…` URL with the name, host, port, type, username, database, and any SSH or SSL settings. The recipient opens it, reviews the prefilled form, adds a password, and saves.
```text theme={null}
tablepro://import?name=Staging&host=db.example.com&port=5432&type=PostgreSQL&username=admin
```
`tablepro://connect/` opens a saved connection rather than importing one. No menu item builds it; see [URL Scheme](/external-api/url-scheme#open-a-connection).
## Import from other apps
Choose **File > Import > Import from Other App…**, pick the source, then review the list and resolve duplicates before clicking **Import**. Groups and folders carry over, and the source app does not have to be running.
| App | Databases | Passwords | Notes |
| ---------------- | --------------------------------------------------------------- | --------------------------------- | ---------------------------------------------------------------------------- |
| TablePlus | MySQL, PostgreSQL, MongoDB, SQLite, Redis, and more | From Keychain | |
| Sequel Ace | MySQL | From Keychain | |
| DBeaver | MySQL, PostgreSQL, SQLite, SQL Server, Oracle, and more | Decrypted from config file | Read from the data folder, so every edition works |
| DataGrip | MySQL, PostgreSQL, SQLite, SQL Server, Oracle, and more | From Keychain or `c.kdbx` | Reads recent projects with SSH and SSL settings. A master password blocks it |
| Beekeeper Studio | MySQL, PostgreSQL, SQLite, SQL Server, Oracle, and more | Decrypted from its `app.db` store | Brings SSH bastion hosts across |
| Navicat | MySQL, MariaDB, PostgreSQL, SQLite, SQL Server, Oracle, MongoDB | Decrypted from `.ncx` file | Export from Navicat first, with **Export Password** on, then pick the `.ncx` |
## On iPhone
TablePro for iPhone reads and writes the same file. Tap the **more** menu (•••) above the connection list and choose **Import Connections**, or open a `.tablepro` file from Files or AirDrop. **Export Connections** shares through the system share sheet, leaving passwords out unless you turn on **Include passwords** and set a passphrase.
## Linked Folders
Needs a [Starter license](/features/licensing).
Press `Cmd+,`, then **Settings > Account > Linked Folders > Add Folder…** and point it at a directory of `.tablepro` files: a Git repo, a Dropbox folder, a network drive. Those connections appear read-only in the sidebar, and each person enters their own password.
## Team Catalog
Needs a [Team license](/features/licensing).
**Share > Publish to Team Catalog…** writes each selected connection as its own `.tablepro` file into a shared folder, asking for the folder the first time. Republishing overwrites the file, and passwords, passphrases, and TOTP secrets are never written. Teammates add that folder as a Linked Folder.
## Environment variables
Needs a [Starter license](/features/licensing).
Write `$VAR` or `${VAR}` in a `.tablepro` file and it resolves from TablePro's process environment at connect time. An app launched from the Dock inherits no shell exports, so set the variable with `launchctl setenv NAME value` or launch TablePro from a terminal.
```json theme={null}
{ "host": "${DB_HOST}", "username": "$DB_USER" }
```
## Password sources
A connection in `~/Library/Application Support/TablePro/connections.json` can say where its password comes from instead of keeping one in the Keychain, which suits a script that provisions connections. The source resolves at connect time, replaces the Keychain lookup rather than supplementing it, and never syncs to iCloud. A source that fails to resolve fails the connection.
```json theme={null}
{ "passwordSource": { "kind": "file", "path": "~/.config/tablepro/secrets/feature-x.pw" } }
{ "passwordSource": { "kind": "env", "variable": "STAGING_DB_PASSWORD" } }
{ "passwordSource": { "kind": "command", "shell": "op read op://vault/feature-x/password" } }
{ "passwordSource": { "kind": "onePassword", "reference": "op://vault/feature-x/password" } }
{ "passwordSource": { "kind": "vault", "path": "secret/data/staging/db", "field": "password" } }
{ "passwordSource": { "kind": "awsSecretsManager", "secretId": "prod/db", "jsonKey": "password" } }
```
| `kind` | Reads from | Set up first |
| ------------------- | ------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------- |
| `file` | The file at `path`, minus a trailing newline | `chmod 600` the file |
| `env` | The named environment variable | Same Dock caveat as environment variables |
| `command` | stdout of the command, run through `/bin/bash`. A non-zero exit fails the connect | |
| `onePassword` | `op read` on the reference | `op signin` |
| `vault` | `vault kv get` for one field at a path | `VAULT_ADDR` and `VAULT_TOKEN` in TablePro's environment |
| `awsSecretsManager` | `aws secretsmanager get-secret-value`. `jsonKey` pulls one field out of a JSON secret; omit it for the whole value | |
Every command gets 30 seconds. The three CLI kinds quote each argument, so a reference cannot break out into the shell, and they need the tool on `PATH`, in `/usr/local/bin`, or in `/opt/homebrew/bin`.
Editing `connections.json` by hand costs one extra step. TablePro stamps the file when it writes it, and a file that changed underneath it fails the connect with *"Your connections file was changed outside TablePro, so this connection's password source was not run. Open the connection and save it again to confirm the change."* Save it once from the app and sources run again.
## File format
JSON. The envelope needs `formatVersion`, `exportedAt`, and `appVersion`; each connection needs `name`, `host`, `port`, `database`, `username`, and `type`, and an empty string is fine where a value does not apply. Groups and tags match by name and are created when missing. Groups export flat, name and color only. Paths use `~/` so they travel.
```json theme={null}
{
"formatVersion": 1,
"exportedAt": "2026-07-14T09:00:00Z",
"appVersion": "0.57.0",
"connections": [
{
"name": "Production",
"host": "db.example.com",
"port": 3306,
"database": "app",
"username": "deploy",
"type": "MySQL",
"tagName": "production"
}
],
"groups": [{ "name": "Backend", "color": "Blue" }],
"tags": [{ "name": "production", "color": "Red" }]
}
```