> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# ClickHouse accounts

> Give people and agents access to a ClickHouse database without sharing its credentials.

A ClickHouse [account](https://infisical.com/docs/documentation/platform/pam/accounts/overview.md) stores the credentials for one ClickHouse user. Members connect in the browser or through the Infisical CLI, and Infisical records every statement they run.

ClickHouse has two interfaces, and an account can use either or both:

* **HTTP**: port `8123`, or `8443` with TLS (the browser and HTTP clients, such as JDBC tools, `clickhouse-connect`, and `curl`, use this interface)
* **Native protocol**: port `9000`, or `9440` with TLS (`clickhouse-client` and other native drivers use this interface)

## Prerequisites

* The Admin [role](https://infisical.com/docs/documentation/platform/pam/concepts/access-control.md) on the [folder](https://infisical.com/docs/documentation/platform/pam/folders/overview.md) you'll add the account to
* A ClickHouse user for Infisical to sign in as
* TLS turned on for both interfaces or for neither, because **SSL Enabled** applies to both
* A [gateway](https://infisical.com/docs/documentation/platform/gateways/overview.md) that can reach the ports you use (to use the native protocol, the gateway must be recent enough to support it)
* A ClickHouse [account template](https://infisical.com/docs/documentation/platform/pam/templates/overview.md)

## Grant the user permissions

A session can do whatever the ClickHouse user can do, so grant the user only what the account's users need:

```sql theme={"dark"}
CREATE USER pam_service IDENTIFIED WITH sha256_password BY '<password>';
GRANT SELECT ON analytics.* TO pam_service;
```

The account's **Database** only sets the database that a session starts in. A session can read every database that the user has a grant on, so limit access with grants instead.

Sessions start with the user's default roles. To switch to another role, run `SET ROLE` in the session.

## Create the account

**Step 1**

Go to **Privileged Access Management** > **Accounts** and select **Add Account**.

**Step 2**

Select the **Folder** and a ClickHouse **Account Template**, then select **Next**.

**Step 3**

Enter a **Name** and the connection details:

| Field | Description |
| - | - |
| **Host** | The server's hostname |
| **HTTP Port** | The HTTP interface's port (leave it empty if the server only serves the native protocol) |
| **Native Port** | The native protocol's port (leave it empty if the server only serves HTTP) |
| **Database** | The database that sessions start in (defaults to `default`) |
| **SSL Enabled** | Whether to connect over TLS (required for ClickHouse Cloud) |
| **Reject Unauthorized** | Whether to reject a server certificate that can't be verified (shown when **SSL Enabled** is on) |
| **SSL Certificate** | The CA certificate that signed the server's certificate (shown when **SSL Enabled** is on) |

Set at least one of the two ports. If you turn on **SSL Enabled**, use the TLS ports.

**Step 4**

Enter the credentials:

| Field | Description |
| - | - |
| **Username** | The ClickHouse user (defaults to `default`) |
| **Password** | The user's password (leave it empty for a user created with `no_password`) |

**Step 5**

Select **Create**. Infisical checks the connection through the gateway before it saves the account, and if the check fails, the error names the port that failed.

## Connect

To open a session, follow [Connect to an account](https://infisical.com/docs/documentation/platform/pam/accounts/connect.md).

**Browser**

The browser needs the account to have an **HTTP Port**. If the account only has a **Native Port**, use the CLI.

The browser session has a table browser and a SQL editor:

* The table browser lists databases where it lists schemas for other account types, because ClickHouse databases don't contain schemas
* The table browser can't edit rows, because ClickHouse applies row changes in the background; to change rows, run `ALTER TABLE ... UPDATE` or `DELETE FROM` in the SQL editor
* The table browser shows the first 1,000 rows of a result
* The browser stops a statement after 30 seconds

For a long query or a full result set, use the CLI.

**CLI**

Start the local proxy. It serves both interfaces on one port on `127.0.0.1`, and prints the port and a connection string:

```bash theme={"dark"}
infisical pam access analytics/clickhouse-prod
```

Connect your client to the port with TLS turned off:

```bash theme={"dark"}
clickhouse-client --host 127.0.0.1 --port <port>
curl 'http://127.0.0.1:<port>/?query=SELECT+1'
```

The gateway signs in for you, so the proxy ignores the username and password that your client sends. Native clients need the account to have a **Native Port**, and HTTP clients need an **HTTP Port**.

## Recording and command blocking

Infisical records every statement in a session and its outcome. To see them, open the session and go to **Session Logs**.

The template's **Command Blocking** patterns apply to ClickHouse statements. If a statement matches a pattern, Infisical rejects the statement before it reaches ClickHouse and records the rejection. Command blocking only matches the text of each statement, so it can't stop SQL that a statement builds while it runs. For restrictions that must always hold, use ClickHouse grants.

If the template uses command blocking, Infisical also rejects an HTTP request if:

* The request body is larger than 1 MB (send large inserts in smaller batches)
* The request body is compressed with anything other than `gzip` or `deflate`

## Next steps

> **[Sessions](https://infisical.com/docs/documentation/platform/pam/sessions/overview)**
>
> Review and end the connections that people and agents make to your accounts.

> **[Access requests](https://infisical.com/docs/documentation/platform/pam/access-requests/overview.md)**
>
> Require approval before a member can use a sensitive account.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.