ClickHouse

Overview

Use ClickHouse credentials to make authenticated API calls through Alter Vault without exposing API keys in code.

Property	Value
Provider ID	clickhouse
Category	Database
Credential Type	Base64 Credentials

Step 1: Get Credentials

Log in to ClickHouse Cloud

Log in to the ClickHouse Cloud Console and open the service.

Note the connection details

Open Connect and note the HTTPS endpoint, username, and password (or create a dedicated database user).

Encode the credentials

Base64-encode the credentials: echo -n 'username:password' | base64 and paste the result into the credential field.

Warning

Never share credentials publicly. Store them securely and only enter them in the Alter Vault Developer Portal.

Step 2: Add to Alter Vault

Open the Developer Portal

Go to portal.alterauth.com and navigate to the application.

Add ClickHouse

Go to Managed Secrets > Add Provider > ClickHouse.

Enter credentials

Paste your Base64 Credentials into the credential field.

Enter the deployment endpoint

Paste your Service HTTPS endpoint — copy it from the ClickHouse Cloud Connect dialog (or use your self-managed server’s HTTPS host). Alter derives this credential’s allowed hosts from that exact host, so proxied calls can only ever reach your deployment. The allowlist cannot be widened or edited separately; rotate the credential with a new endpoint to retarget it.

Save

Click Save. You’ll receive a grant_id to use with the SDK.

Using in Code

response = await alter_app.request(
    HttpMethod.POST,
    "https://YOUR-SERVICE.clickhouse.cloud:8443",
    grant_id="YOUR_GRANT_ID",
    query_params={"query": "SELECT event, count() FROM events GROUP BY event LIMIT 5"},
)

Notes

• The HTTPS interface accepts SQL in the request body and listens on port 8443 on ClickHouse Cloud.

Policy-cataloged operations

Alter policy rules can target these attested operations and families for operation-level and parameter-aware controls.

Operation ID	Families	Method	Provider path
query/get	read	GET	/
query/post	admin, delete, read, write	POST	/
ping	read	GET	/ping
replicas_status	read	GET	/replicas_status
dashboard	read	GET	/dashboard
play	read	GET	/play