How to Integrate Retool with Microsoft SQL Server

Before creating the Retool resource, ensure your SQL Server instance is reachable from Retool's infrastructure. For Retool Cloud connecting to an on-premises SQL Server, you have two main options: whitelist Retool's published IP ranges in your corporate firewall or use SSH tunneling. For IP whitelisting, add the CIDR blocks 35.90.103.132/30 and 44.208.168.68/30 (US West) or the appropriate ranges for your Retool Cloud region to your firewall's allow list for port 1433 (or your custom SQL Server port). For SSH tunneling — the preferred option for sensitive on-premises databases — you will need an SSH bastion host that can reach your SQL Server internally. You configure the SSH host details directly in the Retool resource settings, and Retool will tunnel the SQL Server connection through the SSH host. For Azure SQL Database, navigate to your Azure SQL Server's Networking settings in the Azure portal and add a firewall rule for Retool's IP ranges, or use the 'Allow Azure services and resources to access this server' toggle if Retool Cloud qualifies. For self-hosted Retool deployed in the same VPC as your SQL Server, no IP whitelisting is needed — Retool uses the private network address directly.

In Retool, navigate to the Resources tab in the left sidebar and click '+ Create new resource'. Scroll through the list and select 'Microsoft SQL Server'. On the configuration screen, enter the following: Name — a descriptive name like 'Production SQL Server' or 'Azure SQL (Orders DB)'. Host — the fully qualified hostname or IP address of your SQL Server instance. For Azure SQL, this looks like your-server.database.windows.net. Port — the SQL Server port, defaulting to 1433. Specify an alternate port if your instance uses one. Database name — the specific database you want to connect to (e.g., OrdersDB). Authentication type — choose SQL Server Authentication for standard username/password login, or Windows Authentication for Kerberos-based AD login (self-hosted Retool only; Cloud does not support Kerberos). Username and Password — your SQL Server login credentials. If using SSL, toggle on 'Use SSL' and upload your certificate if using a self-signed cert. If using an SSH tunnel, toggle on 'Connect via SSH tunnel' and enter the SSH host, SSH user, and paste your SSH private key. Click 'Test connection' to verify. A successful connection shows a green indicator and the SQL Server version string.

Open your Retool app and create a new query in the Code panel. Select your SQL Server resource. The query editor defaults to SQL mode, where you write T-SQL directly. Retool's {{ }} syntax works within SQL queries for dynamic parameterization — these expressions are compiled into prepared statements automatically, preventing SQL injection. Use them for filter values, sort columns, and pagination offsets. T-SQL-specific features work natively: CTEs (WITH clauses), window functions, TOP instead of LIMIT, NOLOCK hints, and stored procedure calls using EXEC. For pagination, T-SQL uses OFFSET-FETCH syntax. For date filtering, use Retool's date component values directly in WHERE clauses with CAST or CONVERT functions if needed. You can also call stored procedures: set the query type to 'Run stored procedure' in the query options and specify the procedure name and parameters. For schema exploration, use SELECT * FROM INFORMATION_SCHEMA.TABLES to list available tables, which is useful when building a data browser tool.

1-- T-SQL query with dynamic parameters, pagination, and date filtering
2-- References Retool component values using {{ }} syntax (compiled to prepared statements)
3
4SELECT
5    o.OrderID,
6    o.OrderDate,
7    o.Status,
8    c.CustomerName,
9    c.Email,
10    SUM(oi.Quantity * oi.UnitPrice) AS TotalValue,
11    COUNT(oi.ItemID) AS ItemCount
12FROM Orders o
13INNER JOIN Customers c ON o.CustomerID = c.CustomerID
14INNER JOIN OrderItems oi ON o.OrderID = oi.OrderID
15WHERE
16    o.OrderDate BETWEEN {{ dateRangePicker.start }} AND {{ dateRangePicker.end }}
17    AND o.Status = {{ statusFilter.value }}
18    AND (c.CustomerName LIKE '%' + {{ searchInput.value }} + '%'
19         OR c.Email LIKE '%' + {{ searchInput.value }} + '%')
20GROUP BY o.OrderID, o.OrderDate, o.Status, c.CustomerName, c.Email
21ORDER BY o.OrderDate DESC
22OFFSET {{ (table1.page - 1) * table1.pageSize }} ROWS
23FETCH NEXT {{ table1.pageSize }} ROWS ONLY;

Retool's GUI mode provides a visual interface for INSERT, UPDATE, and DELETE operations that is safer for write operations than raw SQL, especially for less experienced users. In the query editor, click the 'GUI' toggle (next to 'SQL' in the query mode tabs). In GUI mode, select the table you want to modify from a dropdown populated by Retool's schema introspection. Choose the operation type: Bulk insert a list, Update by primary key, Bulk update by primary key, Delete by primary key, or Bulk upsert. For an Update operation, the GUI generates a safe parameterized query under the hood — you just map component values to column names. For example, to update an order status from a selected table row: set Table to 'Orders', Operation to 'Update by primary key', set the primary key (OrderID) to {{ table1.selectedRow.id }}, and add a column mapping for Status → {{ statusDropdown.value }}. GUI mode prevents accidental WHERE-less UPDATE/DELETE statements that would modify all rows. Administrators can lock a resource to GUI mode only in the resource settings, preventing anyone from writing raw UPDATE/DELETE SQL.

1-- Equivalent SQL that Retool GUI mode generates for an Update by primary key
2-- This is shown for reference; in GUI mode you set this up visually
3
4UPDATE Orders
5SET
6    Status = {{ statusDropdown.value }},
7    LastModified = GETDATE(),
8    ModifiedBy = {{ current_user.email }}
9WHERE OrderID = {{ table1.selectedRow.id }};

Production SQL Server instances should use encrypted connections. For SSL configuration in Retool: open the SQL Server resource settings, scroll to the SSL section, and toggle on 'Use SSL'. If your SQL Server uses a certificate from a trusted CA (Let's Encrypt, DigiCert, etc.), no additional configuration is needed. If using a self-signed certificate (common in on-premises environments), enable 'Trust server certificate' or upload the CA certificate PEM file. For Azure SQL, SSL is always required and handled automatically. For SSH tunneling: in the resource settings, toggle on 'Connect via SSH tunnel'. Enter the SSH Hostname (the public IP or hostname of your bastion host), the SSH Port (usually 22), and SSH Username (the user Retool will connect as on the bastion). For authentication, paste your SSH private key in PEM format in the SSH Private Key field — never use password-based SSH in production. The bastion host must be able to reach your SQL Server's hostname and port from its network. Retool will create an encrypted SSH tunnel from its backend to the bastion, then connect to SQL Server through that tunnel. Test the connection to confirm both layers work. For complex enterprise SQL Server setups involving Kerberos, Always Encrypted, or multi-subnet failover clusters, RapidDev's team can help architect and build your Retool solution.