Last updated June 15, 2026

MuleSoft is an Integration Platform as a Service (IPaaS) that connects multiple systems and services together so you can access and manage them from one central interface. This article describes how to connect Heroku Data Services (Heroku Postgres, Apache Kafka on Heroku, and Heroku Key-Value Store) to MuleSoft.

Common Integration Use Cases

The most common use case is to connect Salesforce data stored and managed in Heroku using Heroku Connect and Heroku Postgres. By connecting these Heroku data services to MuleSoft, you can access this data and integrate it with other services also connected to the MuleSoft platform. Using Heroku and MuleSoft together, you can take advantage of the data management flexibility on Heroku while still using any external services your app requires.

Configuring MuleSoft Connectors for the Common Runtime

Integrate Heroku data services (Heroku Key-Value Store, Apache Kafka on Heroku, and Heroku Postgres) into MuleSoft using specific Connectors. This section covers the three connectors necessary for connecting to Heroku data services running on the Common Runtime.

Database Connector

The Database Connector connects any JDBC-compliant database, including Heroku Postgres. To set up a Database Connector in MuleSoft, follow the instructions in “How to connect to Heroku Postgres using the MuleSoft Database Connector”.

Redis Connector

The Redis Connector connects to any Remote Dictionary Server, including Heroku Key-Value Store. To set up a Redis Connector on the MuleSoft side, follow the Redis Connector documentation. Configure the connector with the following details:

• Connection: From the dropdown menu, select “NonClustered”
• Host, Port, Password: From your Key-Value Store connection string (REDIS_URL by default), obtain the hostname, port, and password fields. The Key-Value Store connection string uses the format: rediss://:<password>@<hostname>:<port>.

Apache Kafka Connector

The Kafka Connector connects your Apache Kafka on Heroku cluster to the MuleSoft platform. To set up the Kafka Connector on the MuleSoft side, see “How to connect to Apache Kafka on Heroku using the MuleSoft Kafka Connector”.

Configuring MuleSoft Connectors for Private and Shield Heroku Services

If you use Heroku Postgres, Heroku Key-Value Store, or Apache Kafka on Heroku in a Private or Shield Private space, there’s additional configuration required to set up a secure and mutually authenticated channel between MuleSoft and Heroku. This section covers the steps to connect Heroku data services to MuleSoft when running in Private or Shield Private spaces.

Database Connector

Take these steps first, then configure the database connector as described earlier.

Allowlist Static External IPs

For Heroku Postgres to connect successfully to your MuleSoft app, add the MuleSoft app’s static external IP address to the allowlist in the Heroku mTLS configuration.

1. Use the instructions from MuleSoft’s documentation, allocate a static IP for your app.
2. Add the generated static IP to the mTLS allowlist of your Heroku Postgres database. See Connecting to a Private or Shield Heroku Postgres Database from an External Resource: Allowlist External IPs for detailed instructions.

Download Client-Side Certificates

Use the Heroku CLI to download client-side certificates that authorize a connection between MuleSoft and Heroku. See Connecting to a Private or Shield Heroku Postgres Database from an External Resource: Download Client-Side Certificates for detailed instructions.

Convert Client Private Key to Java-Understandable Format

After downloading the certificates you have a directory in your project called folder by default, unless you specified a different directory name. This directory contains the client private key that MuleSoft requires to connect to the database. Convert the key to a Java format that MuleSoft can read.

Run the following command from your project directory to convert the key. Before you run the command:

• Make sure that you have openssl installed on your command line.
• Replace <CLIENT_PRIVATE_KEY> with the name of the *.key file in your downloaded directory (usually PREFIX_postgresql.key).

$ openssl pkcs8 -topk8 -inform PEM -in <CLIENT_PRIVATE_KEY> -outform DER -nocrypt -out postgresql.key.der

Import Certificates to Your MuleSoft Application

For MuleSoft to access the certificates for the Heroku connection, it’s best to embed them within your MuleSoft app. Move all three downloaded files in folder into the src/main/resources directory of your MuleSoft app.

Configure Database Connection URL

Create a JDBC connection URL to use with the MuleSoft database connector. The URL must use the format:

jdbc:postgresql://<DB_HOST>:<DB_PORT>/<DB_NAME>?sslmode=verify-ca&sslcert=${mule.home}/apps/${app.name}/PREFIX_postgresql.crt&sslkey=${mule.home}/apps/${app.name}/postgresql.key.der&sslrootcert=${mule.home}/apps/${app.name}/PREFIX_root.crt

• Replace <DB_HOST>, <DB_PORT>, and <DB_NAME> with values from your Heroku Postgres database connection string.
• Leave the ${mule.home} and ${app.name} as variables that the Connector replaces at runtime.

The Database Connector also requires configuring Username and Password. Obtain these values from your Heroku Postgres database connection string.

Kafka Connector

Heroku Kafka running in a Private or Shield Space supports mutual TLS connection from external sources. To connect your Private or Shield Heroku Kafka with MuleSoft, add the external static IP of the MuleSoft app to the mTLS allowlist configuration of your cluster.

After you allow mTLS access to MuleSoft, follow the instructions for the Kafka Connector.

Redis Connector

Heroku Key-Value Store running in a Private Space only supports trusted connections from resources using AWS PrivateLink, which MuleSoft doesn’t support.

To connect your Private Heroku Key-Value Store with MuleSoft, use Trusted IP ranges for data services and add the external static IP of the MuleSoft app to the allowlist of your Private Space.

After you allow Trusted IPs access to MuleSoft, follow the instructions for the Redis Connector.