Skip to main content
ClickHouse accounts let you manage access to a ClickHouse database. Users connect through Web Access or the CLI, and every statement they run is recorded in the session. Sessions can use either of ClickHouse’s interfaces: HTTP on port 8123 (8443 with TLS) and the native protocol on port 9000 (9440 with TLS). Each session gets one local port that works with both, and the credential never reaches the client. Set the ports your server serves and leave the other empty. An account needs at least one.

​
Prerequisites

  • A ClickHouse user for Infisical to connect as.
  • At least one interface enabled on the server. Both are on by default, and ClickHouse Cloud serves both.
  • TLS on both interfaces or neither, since SSL Enabled applies to both.
  • A gateway that can reach those ports. A Native Port needs a gateway recent enough to support the native protocol.

​
Creating an account

1

Start adding an account

Go to Privileged Access Management → Accounts and select Add Account.
2

Select a folder and template

Choose which folder to add the account to, then select a ClickHouse template.
3

Enter connection details

4

Enter credentials

5

Save

Select Create. Infisical checks the connection through the gateway before saving, and an error names the port that failed.

​
Permissions

What a session can do comes from the ClickHouse grants on the account’s user, so grant that user only what the people using the account need.
Every session opens on the account’s Database, whatever a client asks for. That is a starting point, not a limit: a session can still read any database the user has a grant on, and Web Access lists them all. Scope the grants, not the Database field. Sessions connect with the user’s default roles. To use another role, run SET ROLE in the session. Command blocking matches the text of each statement, so a statement that builds SQL at runtime can run something a pattern would otherwise reject. Use ClickHouse grants for restrictions that have to hold.

​
Connecting

Web Access provides a browser-based interface with two tools:
  • Data Explorer: browse tables, view data, filter and sort, export to CSV/JSON
  • SQL Editor: write and run SQL queries
To connect:
  1. Go to Privileged Access Management → Accounts
  2. Find the account and select the rocket icon (or select Launch Session from the menu)
  3. Select Connect in Browser
ClickHouse has no schema layer inside a database, so the Data Explorer sidebar lists databases where it lists schemas for other account types.Web Access speaks ClickHouse’s HTTP interface, so it needs the account to have an HTTP Port. On an account with only a native port it is greyed out, and the CLI is the way in.
The Data Explorer shows the first 1,000 rows a statement produces and tells you when there are more, and caps a statement at 30 seconds. Neither limit applies to the CLI, so use it with your own client for a long query or a full result set.
ClickHouse applies row changes as asynchronous mutations rather than as statements that take effect when they return, so the Data Explorer grid is read-only for every table. Run ALTER TABLE ... UPDATE or DELETE FROM from the SQL Editor instead. The column marked as a key in the grid is the table’s sorting key, which ClickHouse calls the primary key: it’s an index, not a unique constraint.

​
Recording

Every statement a session runs is recorded, along with the outcome of each one, and appears under Session Logs on the session. Web Access and the CLI both reach ClickHouse through the gateway, so recording works the same for either. Recordings are encrypted with a per-session key and written to the storage backend the template selects, the same as any other account type. The template’s Command Blocking policy applies to ClickHouse as well: a statement matching one of its patterns is rejected before it reaches ClickHouse, and the rejection is recorded. Session Log Masking patterns are applied to the recording before it’s written. On an account with command blocking, an HTTP request body over 1 MB is refused, as is one compressed with anything other than gzip or deflate. Send large inserts in smaller batches.

​
Servers with HTTP turned off

Set the Native Port and leave HTTP Port empty. Native clients work as usual. Web Access and HTTP clients such as JDBC tools, clickhouse-connect and ODBC need an HTTP port, so Web Access is greyed out on such an account.

​
Next steps

Sessions

View and manage sessions.

Access requests

Require approval before a session starts.