> ## Documentation Index
> Fetch the complete documentation index at: https://planetscale.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# Connect privately with GCP Private Service Connect
> Private connectivity between a Google Cloud VPC and Neki through Private Service Connect.
export const PlatformAvailability = ({current, vitess, postgres, neki}) => {
const docsHref = path => {
if (!path) return path;
const normalized = path.startsWith('/') ? path : `/${path}`;
return normalized;
};
const labels = {
vitess: 'Vitess',
postgres: 'Postgres',
neki: 'Neki'
};
const combinedLabels = {
both: 'Vitess and Postgres',
all: 'Vitess, Neki, and Postgres',
'postgres-neki': 'Postgres and Neki'
};
if (combinedLabels[current]) {
return
{combinedLabels[current]}
;
}
const hasVitess = current === 'vitess' || Boolean(vitess);
const hasPostgres = current === 'postgres' || Boolean(postgres);
const hasNeki = current === 'neki' || Boolean(neki);
const only = [hasVitess, hasPostgres, hasNeki].filter(Boolean).length === 1;
const engines = [];
if (current === 'vitess' || current === 'postgres' || current === 'neki') engines.push(current);
if (hasVitess && current !== 'vitess') engines.push('vitess');
if (hasNeki && current !== 'neki') engines.push('neki');
if (hasPostgres && current !== 'postgres') engines.push('postgres');
return
;
};
[GCP Private Service Connect](https://cloud.google.com/vpc/docs/private-service-connect)
keeps traffic between your VPC and Neki on the Google Cloud network without
traversing the public internet. Use it when your compliance requirements or
network architecture require private database connectivity.
Standard Neki connections use TLS over the public internet and are appropriate
for most applications. Private Service Connect adds network isolation; Neki
still requires TLS for connections through the private endpoint.
## Pricing
PlanetScale bills Private Service Connect ingress and egress at **\$0.01 per
GB** after the branch's included allowance. Google Cloud also charges for
Private Service Connect endpoints and applicable network transfer. See
[Neki pricing](/docs/neki/pricing#private-traffic) and the
[Google Cloud VPC pricing page](https://cloud.google.com/vpc/pricing#private-service-connect).
## Prerequisites
* A Neki database in a GCP region.
* A Google Cloud VPC in the same region as the Neki database.
* IAM permissions to create Private Service Connect endpoints.
* The Cloud DNS and Service Directory APIs enabled in the Google Cloud project.
* A host in the VPC from which you can test DNS and Postgres connectivity.
## Get the private connection details
From the PlanetScale dashboard, select your Neki database.Open **Settings**, then select **Roles**.Select the branch and open the role your application uses.Select the required router group under **Connection target**.Copy the **Private Host** and **Private Service Name**.
The private host and service name identify the Neki service. The role's
generated username still identifies the branch and selected router group. Copy
the complete username from the dashboard instead of constructing it.
Use the service name shown for each role and connection target. Do not assume
that every Neki service in a Google Cloud region has the same service name. An
existing endpoint can be reused only when the dashboard shows the same
**Private Service Name** for the new connection.
## Create the Private Service Connect endpoint
In the Google Cloud console, open **Private Service Connect** and select
**Connected endpoints**.
Select **Connect endpoint**.Select **Published service** as the target.Enter the **Private Service Name** from PlanetScale as the target service.
Enter a descriptive endpoint name. The name becomes the first segment of
the private connection hostname.
Select the VPC and a subnet that your application resources can reach, then
reserve an IP address for the endpoint.
Enable global access if resources in other Google Cloud regions need to
reach this endpoint.
Create a Service Directory namespace so Google Cloud can create the private
DNS record automatically.
Create the endpoint and wait until its status is **Accepted**.
## Build and verify the private hostname
The hostname combines the endpoint name from Google Cloud with the **Private
Host** from PlanetScale:
```text theme={null}
.
```
For example, an endpoint named `planetscale-main` and a private host of
`gcp-us-central1-1.private-pg.psdb.cloud` produce:
```text theme={null}
planetscale-main.gcp-us-central1-1.private-pg.psdb.cloud
```
From a host in the configured VPC, confirm that the hostname resolves to the
endpoint's private address:
```bash theme={null}
dig +short .
```
Then connect using the private hostname and the username and password for your
role:
```bash theme={null}
psql 'host=. port=5432 user= password= dbname=postgres sslnegotiation=direct sslmode=verify-full sslrootcert=system'
```
Update application connection strings by replacing the public host with the
combined private hostname. Keep the generated username, port, database, TLS
settings, and password unchanged.
## Troubleshooting
If the connection fails:
1. Confirm that the endpoint status is **Accepted**.
2. Confirm that the endpoint is in the same GCP region as the Neki database.
3. Verify that the Cloud DNS and Service Directory APIs are enabled.
4. Check that the application can route to the endpoint subnet.
5. Confirm that the combined hostname resolves to the endpoint's private
address.
6. Check firewall rules for outbound TCP traffic on port `5432`.
## Related documentation
* [Connect to Neki](/docs/neki/connecting)
* [Roles and credentials](/docs/neki/connecting/roles)
* [Neki pricing](/docs/neki/pricing#private-traffic)
## Need help?
Get help from [the PlanetScale Support team](https://planetscale.com/contact?initial=support), or join our [Discord community](https://pscale.link/community) to see how others are using PlanetScale.