Configure private endpoints

Private endpoints let your applications reach Pinecone indexes through AWS PrivateLink or Azure Private Link, so traffic between your network and Pinecone stays off the public internet.

Private endpoints carry data plane traffic only. Control plane requests, such as creating or describing an index, still go over the public internet.
Each private endpoint belongs to one project and connects only to that project’s indexes in one region. You can add up to 10 private endpoints per project.

Before you begin

Make sure you have the following:

A Pinecone Enterprise plan
The owner role in the Pinecone project you want to connect to
A serverless index in one of the regions listed in step 1

AWS
Azure

Access to the AWS console
An Amazon VPC in the same region as your index

Set up a private endpoint

1. Create a private endpoint in your cloud provider

Create an endpoint in your VPC or VNet that connects to Pinecone’s service in your index’s region:

AWS
Azure

In the Amazon VPC console, go to Endpoints and click Create endpoint.
For Type, select Endpoint services that use NLBs and GWLBs.

For Service name, enter the service name for your index’s region, and then click Verify service:

Index region	Service name
`us-east-1` (N. Virginia)	`com.amazonaws.vpce.us-east-1.vpce-svc-05ef6f1f0b9130b54`
`us-west-2` (Oregon)	`com.amazonaws.vpce.us-west-2.vpce-svc-04ecb9a0e0d5aab01`
`eu-west-1` (Ireland)	`com.amazonaws.vpce.eu-west-1.vpce-svc-03c6b7e17ff02a70f`
`eu-central-1` (Frankfurt)	`com.amazonaws.vpce.eu-central-1.vpce-svc-037997ff6b3d25e34`
`ap-southeast-1` (Singapore)	`com.amazonaws.vpce.ap-southeast-1.vpce-svc-0c12f00812e786068`

For VPC, select the VPC your clients connect from.
(Optional) In Additional settings, select Enable DNS name. This lets clients in the VPC resolve Pinecone’s private DNS names without extra setup. It requires DNS hostnames and DNS resolution to be enabled on the VPC. If you leave it off, or clients outside the VPC need to connect, you’ll set up DNS yourself in step 3.
Select the Subnets for the endpoint, and select Security groups that allow inbound HTTPS (port 443) from your clients.
Click Create endpoint.
Copy the VPC endpoint ID (e.g., vpce-XXXXXXX). You’ll enter it in Pinecone in the next step.

In the Azure portal, search for Private Link and select Private Link Center. Then go to Private endpoints and click Create.
Select your Subscription and Resource group, enter a Name for the private endpoint, and select the Region that matches your index. Then click Next: Resource.
For Connection method, select Connect to an Azure resource by resource ID or alias, and enter the Resource ID or alias for your index’s region:
Index region Private Link Service alias
eastus2 (Virginia) pinecone.bdbc7759-0243-46c1-af51-794c4602745b.eastus2.azure.privatelinkservice
Click Next: Virtual Network, and select the Virtual network and Subnet for the private endpoint.
Click Next: DNS, and skip this tab. You’ll set up DNS in step 3.
Click Next: Tags, then Review + create, and then Create.
After Azure creates the private endpoint, open it, go to Properties, and copy the Resource ID (e.g., /subscriptions/<sub-uuid>/resourceGroups/<rg>/providers/Microsoft.Network/privateEndpoints/<name>). You’ll enter it in Pinecone in the next step.

Index region	Private Link Service alias
`eastus2` (Virginia)	`pinecone.bdbc7759-0243-46c1-af51-794c4602745b.eastus2.azure.privatelinkservice`

2. Add a private endpoint in Pinecone

Add the endpoint to your Pinecone project so Pinecone accepts connections through it:

In the Pinecone console, select your project and go to Settings > Network.
On the PRIVATE ENDPOINTS tab, click Add an endpoint.
Select your cloud provider and your index’s region, and then click Next.
Enter the ID you copied in step 1, and then click Next:
- AWS: The VPC endpoint ID.
- Azure: The private endpoint’s resource ID.
Leave Restrict access to only private endpoints off for now. Turning it on cuts off internet access to the project before your private endpoint works. You can turn it on later.
Click Finish setup.

3. Configure DNS

Clients reach an index through its private endpoint URL, such as docs-example-jl7boae.svc.private.aped-4627-b74a.pinecone.io. Public DNS doesn’t resolve these names, so DNS on your network must resolve them to your private endpoint’s IP address. Clients must connect by hostname rather than IP address, because Pinecone’s TLS certificate is issued for the hostname, not the IP address. Each region has one private DNS zone. A single wildcard record (*) in that zone covers every index in the region:

Cloud	Index region	Private DNS zone
AWS	`us-east-1` (N. Virginia)	`private.aped-4627-b74a.pinecone.io`
AWS	`us-west-2` (Oregon)	`private.apw5-4e34-81fa.pinecone.io`
AWS	`eu-west-1` (Ireland)	`private.apu-57e2-42f6.pinecone.io`
AWS	`eu-central-1` (Frankfurt)	`private.apec-a2ee-38c6.pinecone.io`
AWS	`ap-southeast-1` (Singapore)	`private.aps-d9bb-582b.pinecone.io`
Azure	`eastus2` (Virginia)	`private.eastus2-5e25.prod-azure.pinecone.io`

Clients also need a network route to the private endpoint’s IP address on port 443. For clients outside the VPC or VNet, such as on-premises servers, that usually means a VPN, AWS Direct Connect, Azure ExpressRoute, or network peering.

AWS
Azure

If you selected Enable DNS name when you created the VPC endpoint, clients in that VPC already resolve Pinecone’s private DNS names. Set up DNS yourself if you turned that option off, or if clients outside the VPC need to connect:

Route 53 private hosted zone: Create a private hosted zone named after your region’s private DNS zone and associate it with your VPCs. Then add a wildcard record (*) that routes traffic to the VPC endpoint.
Your own DNS server: On your organization’s DNS server, create a zone named after your region’s private DNS zone. Add a wildcard CNAME record (*) that points to the VPC endpoint’s regional DNS name, which has the form vpce-XXXXXXX.vpce-svc-XXXXXXX.REGION.vpce.amazonaws.com. AWS publishes that name in public DNS, and it resolves to the endpoint’s private IP addresses. To get it, run aws ec2 describe-vpc-endpoints --vpc-endpoint-ids VPC_ENDPOINT_ID --query 'VpcEndpoints[*].DnsEntries'. The first entry is the regional DNS name.
Forward to Route 53: If you selected Enable DNS name, you can keep AWS as the source of these records instead. Create a Route 53 Resolver inbound endpoint in the VPC, and then add a conditional forwarder on your DNS server that sends queries for the private DNS zone to the inbound endpoint’s IP addresses.

Azure doesn’t resolve Pinecone’s private DNS names automatically, so you must set up DNS. First, find your private endpoint’s IP address. In the Azure portal, open your private endpoint, and on its Overview page, select its network interface. The network interface’s Overview page shows the Private IP address (e.g., 172.30.0.6).Then set up DNS in one of the following ways.

Use an Azure Private DNS zone

Use this option if your clients use Azure-provided DNS.

Create an Azure Private DNS zone named private.eastus2-5e25.prod-azure.pinecone.io.
Link the zone to the VNet where you created the private endpoint, and to any other VNets whose clients connect to Pinecone.
Add a wildcard A record (*.private.eastus2-5e25.prod-azure.pinecone.io) that points to your private endpoint’s IP address.

Use your own DNS server

Use this option if your organization runs its own DNS server.

On your DNS server, create a zone named private.eastus2-5e25.prod-azure.pinecone.io.
Add a wildcard A record (*.private.eastus2-5e25.prod-azure.pinecone.io) that points to your private endpoint’s IP address.
Make sure the clients that connect to Pinecone use this DNS server.

Forward to an Azure Private DNS zone

Use this option if your organization runs its own DNS but manages private endpoint records in Azure.

Set up an Azure Private DNS zone as described above.
Create an Azure DNS Private Resolver with an inbound endpoint in a VNet that’s linked to the zone.
On your DNS server, add a conditional forwarder that sends queries for private.eastus2-5e25.prod-azure.pinecone.io to the inbound endpoint’s IP address.

For more on these patterns, see Azure Private Endpoint DNS integration.

A private endpoint keeps its IP address for as long as it exists. If you point an A record at that address and later delete and re-create the endpoint, update the record with the new address.

To check your setup, look up your index’s private endpoint URL from a client machine. Replace the example host with your index’s Private host value from step 4:

Terminal

nslookup docs-example-jl7boae.svc.private.aped-4627-b74a.pinecone.io

The response should return your private endpoint’s IP address. If the lookup fails or returns a different address, the client isn’t using the DNS server or zone you configured.

4. Connect to your index

To send data operations through your private endpoint, target the index by its private endpoint URL instead of its standard host. The only difference is that .svc. becomes .svc.private.. You can get the private endpoint URL for an index from the Pinecone console or API.

Console
API

To get the private endpoint URL for an index from the Pinecone console:

Open the Pinecone console.
Select the project containing the index.
Select the index.
Copy the Private host value.

To get the private endpoint URL for an index from the API, use the Describe an index operation, which returns the private endpoint URL as the private_host value:

import { Pinecone } from '@pinecone-database/pinecone';

const pc = new Pinecone({ apiKey: 'YOUR_API_KEY' });

await pc.describeIndex('docs-example');

package main

import (
    "context"
    "encoding/json"
    "fmt"
    "log"

    "github.com/pinecone-io/go-pinecone/v4/pinecone"
)

func prettifyStruct(obj interface{}) string {
    bytes, _ := json.MarshalIndent(obj, "", "  ")
    return string(bytes)
}

func main() {
    ctx := context.Background()

    pc, err := pinecone.NewClient(pinecone.NewClientParams{
        ApiKey: "YOUR_API_KEY",
    })
    if err != nil {
        log.Fatalf("Failed to create Client: %v", err)
    }

    idx, err := pc.DescribeIndex(ctx, "docs-example")
    if err != nil {
        log.Fatalf("Failed to describe index \"%v\": %v", idx.Name, err)
    } else {
        fmt.Printf("index: %v\n", prettifyStruct(idx))
    }
}

PINECONE_API_KEY="YOUR_API_KEY"

curl -i -X GET "https://api.pinecone.io/indexes/docs-example" \
    -H "Api-Key: $PINECONE_API_KEY" \
    -H "X-Pinecone-Api-Version: 2026-07"

The response includes the private endpoint URL as the private_host value:

{
  name: 'docs-example',
  dimension: 1536,
  metric: 'cosine',
  host: 'docs-example-jl7boae.svc.aped-4627-b74a.pinecone.io',
  privateHost: 'docs-example-jl7boae.svc.private.aped-4627-b74a.pinecone.io',
  deletionProtection: 'disabled',
  tags: { environment: 'production' },
  embed: undefined,
  spec: {
    byoc: undefined,
    pod: undefined,
    serverless: { cloud: 'aws', region: 'us-east-1' }
  },
  status: { ready: true, state: 'Ready' },
  vectorType: 'dense'
}

index: {
  "name": "docs-example",
  "dimension": 1536,
  "host": "docs-example-jl7boae.svc.aped-4627-b74a.pinecone.io",
  "private_host": "docs-example-jl7boae.svc.private.aped-4627-b74a.pinecone.io",
  "metric": "cosine",
  "deletion_protection": "disabled",
  "spec": {
    "serverless": {
      "cloud": "aws",
      "region": "us-east-1"
    }
  },
  "status": {
    "ready": true,
    "state": "Ready"
  },
  "tags": {
    "environment": "production"
  }
}

{
  "name": "docs-example",
  "host": "docs-example-jl7boae.svc.aped-4627-b74a.pinecone.io",
  "private_host": "docs-example-jl7boae.svc.private.aped-4627-b74a.pinecone.io",
  "status": {
    "ready": true,
    "state": "Ready"
  },
  "deployment": {
    "deployment_type": "managed",
    "region": "us-east-1",
    "cloud": "aws",
    "environment": "aped-4627-b74a"
  },
  "read_capacity": {
    "mode": "OnDemand",
    "status": {
      "state": "Ready",
      "current_shards": null,
      "current_replicas": null
    }
  },
  "schema": {
    "fields": {
      "embedding": {
        "type": "dense_vector",
        "description": null,
        "dimension": 1536,
        "metric": "cosine"
      }
    }
  },
  "tags": {
    "environment": "production"
  },
  "deletion_protection": "disabled"
}

If you restrict access to private endpoints, requests that don’t come through a private endpoint get an Unauthorized response. Requests through a private endpoint that isn’t registered to the index’s project also get Unauthorized.

Restrict access to private endpoints

After your private endpoint works, you can turn off internet access to the project. Then only requests that come through a private endpoint can read or write the project’s indexes.

This setting applies to the whole project. Any application that reaches an index in the project over the internet stops working.

In the Pinecone console, select your project and go to Settings > Network.
On the ACCESS tab, turn on Restrict access to only private endpoints.
Click Confirm and proceed.

To turn internet access back on, turn the toggle off.

Manage private endpoints

To view a project’s private endpoints, open the Pinecone console, select the project, and go to Settings > Network. The PRIVATE ENDPOINTS tab lists each endpoint’s ID, cloud, and region. To delete a private endpoint:

On the PRIVATE ENDPOINTS tab, open the Actions menu for the endpoint and click Delete.
Enter the endpoint ID to confirm, and then click Delete Endpoint.

Deleting a private endpoint in Pinecone doesn’t delete the endpoint in your AWS or Azure account. Delete it there separately if you no longer need it.

Get started

Core concepts

Index data

Search

Optimize

Manage data

Manage cost

Move to production

Admin

Operations

Using pods

Configure private endpoints

Before you begin

Set up a private endpoint

1. Create a private endpoint in your cloud provider

2. Add a private endpoint in Pinecone

3. Configure DNS

Use an Azure Private DNS zone

Use your own DNS server

Forward to an Azure Private DNS zone

4. Connect to your index

Restrict access to private endpoints

Manage private endpoints

​Before you begin

​Set up a private endpoint

​1. Create a private endpoint in your cloud provider

​2. Add a private endpoint in Pinecone

​3. Configure DNS

​Use an Azure Private DNS zone

​Use your own DNS server

​Forward to an Azure Private DNS zone

​4. Connect to your index

​Restrict access to private endpoints

​Manage private endpoints

Before you begin

Set up a private endpoint

1. Create a private endpoint in your cloud provider

2. Add a private endpoint in Pinecone

3. Configure DNS

Use an Azure Private DNS zone

Use your own DNS server

Forward to an Azure Private DNS zone

4. Connect to your index

Restrict access to private endpoints

Manage private endpoints