Connect ClickHouse so Coworker can see who is querying what, how your schemas change, and what your organization is spending. ClickHouse is admin-connected through two credential surfaces.
What Coworker can do with ClickHouse
Index your schema catalog and query statistics — the "who queried what" activity signal
Provide a read-only SQL tool so Coworker can answer data questions directly
Track organization events from ClickHouse Cloud: the team roster, service catalog, audit log and credit spend
Produce one activity report per service with query activity, schema drift or service-scoped admin events. Idle services produce nothing.
Indexed content carries private access policies derived from database-level visibility. Nothing is marked workspace-public, and a locked-down ClickHouse stays locked down in Coworker.
Before you start
You must be a Coworker Network Admin. At least one of these is required; both together give full telemetry:
ClickHouse Cloud API key — key ID, key secret, and optionally an organization ID
Read-only database user — host, protocol, port and database allowlist
Connect as an admin
Open Data Sources from the admin settings in Coworker and select ClickHouse.
To add the Cloud API key, create one in ClickHouse Cloud and paste the key ID and secret. Use the Admin role for full telemetry — the organization audit log is only readable with Admin. Least-privilege alternatives are Service API Reader + Billing, or Developer on older organizations.
To add the database user, run the copyable SQL shown in the connect form. It creates a dedicated
coworker_rouser under areadonly = 2settings profile, so writes and DDL are blocked at the server level.Save.
Connect as a member
ClickHouse has no per-user connection flow. One admin connection covers the workspace.
Good to know
A Cloud key alone loses query activity and schemas. A database user alone loses per-service reporting grain and degrades identity to database usernames. Self-hosted ClickHouse is database-only by nature.
On ClickHouse Cloud,
GRANT SELECT ON *.*fails for every user. UseGRANT CURRENT GRANTS(SELECT ON *.*), which the connect form leads with.Coworker only makes read-only calls through the API key.
PrivateLink endpoints are refused at connect time — only public endpoints are reachable.