> ## Documentation Index > Fetch the complete documentation index at: https://infisical.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # ClickHouse credentials > Learn how to automatically rotate the passwords of ClickHouse users. Rotate the passwords of two ClickHouse users on a schedule, and give your applications the active username and password through Infisical secrets. > [!NOTE] > > **Rotation Type: Dual-Phase** > > This rotation maintains two active credential sets with overlapping validity, ensuring zero-downtime during rotation cycles. > [!NOTE] > > This rotation needs a [ClickHouse app connection](https://infisical.com/docs/integrations/app-connections/clickhouse.md). This guide walks you through creating a project-scoped app connection. ## Prerequisites * A [project with secrets configured](https://infisical.com/docs/documentation/platform/secrets-mgmt/quick-starts/deliver-first-secret.md) * A ClickHouse user that can create users and grant privileges, such as `default` * Network access from Infisical to the HTTP interface of your ClickHouse server, or a [Gateway](https://infisical.com/docs/documentation/platform/gateways/overview.md) that can reach it ## Step 1: Create a ClickHouse user for Infisical Infisical needs a ClickHouse user with the `ALTER USER` privilege, which lets it change the passwords of the users it rotates. **Step 1** Connect to ClickHouse as a user that can create users and grant privileges, such as `default`, and create a user for Infisical: ```sql theme={"dark"} CREATE USER infisical IDENTIFIED WITH sha256_password BY ''; ``` **Step 2** Grant the user the `ALTER USER` privilege: ```sql theme={"dark"} GRANT ALTER USER ON *.* TO infisical; ``` ## Step 2: Create the users to rotate Your applications sign in to ClickHouse as one of two users that you create. > [!NOTE] > > Rotation alternates between these two users, changing one password per cycle so that the other stays valid while your applications pick up the new credentials. See [why two users are required](https://infisical.com/docs/documentation/platform/secret-rotation/overview#why-two-users). **Step 1** Create the two users with `CREATE USER`. Infisical replaces both passwords when you create the rotation, so any temporary password works: ```sql theme={"dark"} CREATE USER infisical_user_1 IDENTIFIED WITH sha256_password BY 'temporary_password'; CREATE USER infisical_user_2 IDENTIFIED WITH sha256_password BY 'temporary_password'; ``` Infisical can't change the password of a user defined in a ClickHouse configuration file such as `users.xml`. **Step 2** Grant both users the privileges your applications need, such as: ```sql theme={"dark"} GRANT SELECT ON my_database.* TO infisical_user_1, infisical_user_2; ``` > [!NOTE] > > If you self-host a ClickHouse cluster that stores users separately on each server, Infisical changes the password only on the server it connects to. To apply the change on every server, store users in [replicated user storage](https://clickhouse.com/docs/operations/server-configuration-parameters/settings#user_directories). ClickHouse Cloud already does this. ## Step 3: Set up the rotation in Infisical > [!TIP] > > To create the rotation using the API, use the [Create ClickHouse Credentials Rotation](https://infisical.com/docs/api-reference/endpoints/secret-rotations/clickhouse-credentials/create.md) endpoint. **Step 1** In your Secrets Manager project, open the dashboard and select **Add Secret Rotation** from the actions dropdown. ![Add Secret Rotation](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-rotations-v2/generic/add-secret-rotation.png) Then, select the **ClickHouse Credentials** option. **Step 2** Under **Configuration**, choose the app connection and when the rotation runs: * **Environment**: The project environment the rotated secrets are stored in * **ClickHouse Connection**: The app connection the rotation uses * **Rotation Interval (In Days)**: The number of days between rotations * **Rotate At (Local Time)**: The time of day the rotation runs * **Auto-Rotation Enabled**: When enabled, the passwords rotate on the schedule; turn it off to rotate manually only > [tab] Create a new app connection > > Under **ClickHouse Connection**, select **Create ClickHouse Connection** in the dropdown, then fill in: > > * **Name**: A descriptive name for the connection > * **Description** (optional): A note for future reference > * **Gateway** (optional): The [Gateway](https://infisical.com/docs/documentation/platform/gateways/overview.md) Infisical connects through, if Infisical can't reach your ClickHouse server directly, such as when the server is in a private network > * **Method**: **Username & Password** > * **Host**: The hostname or IP address of your ClickHouse server, without `https://` or a port, such as `.us-east-1.aws.clickhouse.cloud` > * **Database Name**: The database Infisical connects to, such as `default` > * **Port**: The port of the ClickHouse HTTP interface (usually `8443` for HTTPS, including ClickHouse Cloud, and `8123` for HTTP) > * **Username**: The user you [created in Step 1](#step-1-create-a-clickhouse-user-for-infisical) > * **Password**: The password of that user > * **Enable SSL**: On the **SSL** tab, whether Infisical connects over HTTPS (on by default; turn it off for an HTTP port such as `8123`) > * **SSL Certificate** (optional): On the **SSL** tab, the CA certificate in PEM format that signed your server's TLS certificate (ClickHouse Cloud doesn't need one) > * **Reject Unauthorized**: On the **SSL** tab, whether Infisical refuses to connect when it can't verify the server's TLS certificate (on by default; for a self-signed certificate, enter its CA certificate in **SSL Certificate** instead of turning this off) > > Select **Connect to Database**. Infisical returns you to the rotation form with the new connection selected. > > > [!NOTE] > > > > This creates a connection scoped to the current project. To share the connection across other projects, [create it at the organization level](https://infisical.com/docs/integrations/app-connections/clickhouse.md#step-2-create-the-app-connection) first, then select it here. > [tab] Use an existing connection > > Under **ClickHouse Connection**, select the app connection you'd like to use. Then select **Continue**. **Step 3** Under **Parameters**, enter the users you [created in Step 2](#step-2-create-the-users-to-rotate): * **Database Username 1**: The first user, such as `infisical_user_1` * **Database Username 2**: The second user, such as `infisical_user_2` Then select **Continue**. **Step 4** Under **Mappings**, choose the names of the Infisical secrets that hold the rotated values: * **Username**: The name of the secret that holds the username of the active user * **Password**: The name of the secret that holds the password of the active user Then select **Continue**. **Step 5** Give the rotation a **Name** and an optional **Description**. The name must be slug-friendly. Then select **Continue**. **Step 6** Review your ClickHouse Credentials Rotation configuration, then select **Create secret rotation**. > [!TIP] > > The rotated credentials are now available through the mapped secrets. If auto-rotation is enabled, they rotate on your configured schedule. ## Next steps > [card] [Overview](https://infisical.com/docs/documentation/platform/secret-rotation/overview) > > Learn how rotation schedules work and why database rotations use two users. > [card] [ClickHouse](https://infisical.com/docs/integrations/app-connections/clickhouse.md) > > Create a ClickHouse connection that every project in your organization can use. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.