Databases, Environment Variables and Secrets

Creating PostgreSQL

New → PostgreSQL, choose the same region as your web service, pick a plan and create. Render shows two connection strings:

• Internal Database URL: for services in the same region. Use this from your app; traffic stays on Render's private network.
• External Database URL: for connecting from your laptop (psql, migrations, admin tools). Restrict access with the IP allowlist.

Environment variables

In the service's Environment tab:

DATABASE_URL=<internal database URL>
SECRET_KEY=<64 random hex characters>
FLASK_ENV=production
STRIPE_SECRET_KEY=...
RESEND_API_KEY=...

• Values are stored encrypted and injected at runtime. Changing one triggers a redeploy.
• Environment Groups share variables between services (web, worker, cron).
• Secret Files hold whole files (for example a service-account JSON) mounted into the filesystem.
• Generate secrets with python -c "import secrets; print(secrets.token_hex(32))".

Some libraries give postgres:// URLs; SQLAlchemy needs postgresql://. Normalise it in your config.

Connection pools and plan limits

Each plan allows a maximum number of database connections. Total connections = instances × workers × (pool size + overflow). Keep that under the limit, read pool sizes from environment variables, and add a pooler if you scale out (see Database Administration).

Backups

Paid PostgreSQL plans include point-in-time recovery for a number of days. Check your plan, and practise restoring to a new database. For extra safety, schedule your own pg_dump to object storage with a cron job.

Redis-compatible Key Value

Create a Key Value instance for caching, rate limits and task queues and pass its internal URL as REDIS_URL. With more than one Gunicorn worker or instance, rate limits must live in Redis, or each process counts separately.

Exercise

Create a PostgreSQL database and a Key Value instance, wire them to your web service with internal URLs in an environment group, and confirm the app connects by visiting a page that reads from the database.

Check yourself

• Which database URL should your app use, and why?
• What are Environment Groups for?
• Why must rate limits use Redis with several workers?