> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getmodus.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Trino

> Connect your Trino cluster to Modus so your scopes have rich context about your data.

Connect a Trino cluster to Modus so its catalogs, schemas, tables, and columns
become context that Modus can reason over. Modus connects **read-only** over
TLS and stores your credentials encrypted in AWS Secrets Manager.

## Prerequisites

Before you begin, make sure you have:

* The **host** and **port** of your Trino coordinator (TLS, default `8443`).
* Credentials Modus can use — either a **username and password**, or a **JWT** minted by your identity provider.
* Read access to the catalogs and schemas you want Modus to use as context.

## Set up read-only access

Trino access control is deployment-specific, but the principle is the same: give
Modus an identity that can **connect, list catalogs and schemas, and `SELECT`**
from the schemas you want it to use as context — nothing more.

* **Username / password** — use an existing read-only account, or create one in your Trino authentication backend (LDAP, password file, etc.).
* **JWT** — configure your identity provider to mint a bearer token for the Trino coordinator; Modus derives the identity from the token.

The identity needs to run `SELECT 1`, `SHOW CATALOGS`, `SHOW SCHEMAS`, and
`SELECT` on the target schemas. No write access is required.

## Network access

If your Trino cluster is behind a firewall or security group, allow Modus's
egress IP addresses so it can reach the coordinator. See
[IP Allowlisting](/guides/ip-allowlist).

## Connect in Modus

<Steps>
  <Step title="Open the Trino connection form">
    1. Log into [Modus](https://app.getmodus.com).
    2. Click **Integrations** in the left sidebar.
    3. Find the **Trino** card under **Databases** and click **Connect**.
  </Step>

  <Step title="Fill in the connection details">
    Complete the form using the [field reference](#connection-form-field-reference)
    below. Choose your **Authentication Method** — the form shows the matching
    fields (password or JWT).

    <Frame>
      <img src="https://mintcdn.com/modus-c77f86cb/1jIq7yXvNUfzqZYd/images/trino-integration/connection-form.png?fit=max&auto=format&n=1jIq7yXvNUfzqZYd&q=85&s=283aa63a9fb3747a61967b4ad201cb4c" alt="Modus Trino connection form" width="1440" height="900" data-path="images/trino-integration/connection-form.png" />
    </Frame>
  </Step>

  <Step title="Test and save">
    1. Click **Test Connection** to verify Modus can reach your cluster.
    2. Click **Save Connection**.
  </Step>

  <Step title="Select schemas">
    After saving, Modus lists the catalogs and schemas your identity can access.
    Select the ones you want Modus to use as context, then save. Nothing is
    scanned without your explicit selection.
  </Step>
</Steps>

## Connection form field reference

| Field                            | Description                                   | Example                       |
| -------------------------------- | --------------------------------------------- | ----------------------------- |
| **Connection Name**              | A friendly name for this connection           | `Production Trino`            |
| **Host**                         | Trino coordinator hostname                    | `trino.example.com`           |
| **Port**                         | Coordinator port (TLS)                        | `8443`                        |
| **Default Catalog** *(optional)* | Catalog to use by default                     | `hive`                        |
| **Default Schema** *(optional)*  | Schema to use by default                      | `default`                     |
| **Authentication Method**        | `Username / Password` or `JWT (Bearer Token)` | `Username / Password`         |
| **Username** / **Password**      | Credentials (password auth)                   | `modus_readonly`              |
| **JWT Token**                    | Bearer token (JWT auth)                       | *(your token)*                |
| **CA Certificate** *(optional)*  | PEM CA cert for self-signed TLS               | `-----BEGIN CERTIFICATE-----` |

## Troubleshooting

| Symptom                            | Likely cause                                                                                      |
| ---------------------------------- | ------------------------------------------------------------------------------------------------- |
| **Connection failed / timeout**    | Wrong host/port, or Modus's egress IPs aren't allowlisted. See [Network access](#network-access). |
| **TLS / certificate error**        | Self-signed certificate — paste your CA certificate into the **CA Certificate** field.            |
| **Authentication failed**          | Wrong username/password, or an invalid/expired JWT.                                               |
| **No schemas listed after saving** | The identity can't `SHOW`/`SELECT` the catalogs and schemas.                                      |

## Verification

Your Trino cluster is now connected. Modus turns the selected catalogs, schemas,
tables, and columns into context so Modus can give accurate, data-aware
answers.

Need help? Contact us at [support@getmodus.com](mailto:support@getmodus.com).

<Note>
  Modus connects read-only and requests only the minimum permissions needed to
  understand and query your data. All credentials are encrypted and stored in AWS
  Secrets Manager — never in plaintext.
</Note>