Docs / ClickHouse

Connect ClickHouse

Column-oriented analytics database

ClickHouse is a column-oriented OLAP database built for real-time analytical queries. climpt connects with ordinary credentials over HTTPS or the native TLS protocol.

Credentials

Host
Hostname or IP, for example clickhouse.example.com.
Port
8443 for HTTPS or 9440 for native TLS. Never the unencrypted 8123 or 9000.
Database
The database to query, for example analytics.
Username
The read-only user created below.
Password
That user’s password.

Creating a read-only user

Connect as an admin with clickhouse-client and create a user with readonly = 1, which blocks INSERT, ALTER and CREATE at the user level rather than relying on grants alone.

CREATE USER climpt_readonly
IDENTIFIED WITH sha256_password BY 'strong_password_here'
SETTINGS readonly = 1;

GRANT SELECT ON analytics.* TO climpt_readonly;

Optional — metadata introspection

GRANT SELECT ON system.columns TO climpt_readonly;
GRANT SELECT ON system.tables TO climpt_readonly;

Verifying

Confirm the account genuinely cannot write. This command should fail.

clickhouse-client --user climpt_readonly --password 'strong_password_here' \
  --query "INSERT INTO analytics.test VALUES (1)"

Then check TLS is enabled in config.xml under <https_port>, and that your firewall exposes the chosen port only to the addresses that need it.

ClickHouse Cloud

Managed instances arrive with TLS and IP allowlisting already in place. Every SQL statement above applies unchanged.

  • Copy the HTTPS endpoint from the ClickHouse Cloud console.
  • The port is 8443.
  • Add our address under Settings → Security.
  • You can use the default user, but a dedicated read-only one is better.

Worth knowing

  • readonly = 1 is what makes the account read-only. Grants alone leave it up to which grants you remembered.
  • Use sha256_password or double_sha1_password for authentication.
  • ClickHouse uses double quotes for identifiers: "my-table".
  • Set max_concurrent_queries_for_user to bound how much of the cluster this connection can occupy.
  • Granting SELECT on specific tables rather than the whole database is tighter still, if you know which tables you want analysed.
  • Rotate the password roughly every 90 days.