Skippr Docs

Appearance

How to Manage ClickHouse Destination Credentials in Skippr ​

July 2026

Keep ClickHouse destination credentials safe by interpolating the password from CLICKHOUSE_PASSWORD, limiting the write user, and pairing that auth model with the documented ReplacingMergeTree CDC behavior.

Short Answer ​

Manage ClickHouse destination credentials in Skippr by keeping url, database, and user visible in config while loading password from ${CLICKHOUSE_PASSWORD}. That is the auth surface the docs define, and it is the safest way to keep the HTTP endpoint reviewable without exposing the write credential.

The destination side needs one more piece of discipline than the source side because the warehouse behavior matters too. When CDC is enabled, Skippr uses ReplacingMergeTree semantics, creates _skippr_order_token and tombstone tables automatically, and relies on background merges for final-state convergence. That means the write user should stay narrow and the query model should be documented well enough that readers know when FINAL is required on fresh data.

Why Teams Struggle with This ​

Teams usually focus only on the password and miss the second real issue: a ClickHouse destination can be securely configured and still confuse downstream readers if no one documents the CDC read model. Secure auth and correct warehouse behavior have to be explained together here.

  • Putting the ClickHouse password directly into config leaks the write credential.
  • Using a broad admin account for loads creates more risk than a destination writer needs.
  • If analysts expect deduped current state immediately after every write, the destination will look wrong even when auth is correct.
  • A network path to the ClickHouse HTTP endpoint is still required, so credential rotation alone does not solve connectivity failures.

How Skippr Handles It ​

Skippr keeps the auth model clean by letting you expose only the operational fields and protect only the password. That makes it obvious which ClickHouse database receives the load without revealing the secret that allows writes.

Skippr also follows the documented CDC contract instead of faking instant row replacement. Order-token columns decide which version is newer, tombstones prevent stale resurrected rows, and FINAL is available when you need point-in-time correctness on fresh data.

  • Uses password: ${CLICKHOUSE_PASSWORD} for the secret-bearing field.
  • Keeps url, database, and user visible so the destination target is reviewable.
  • Supports ReplacingMergeTree-based CDC with _skippr_order_token and tombstone tables.
  • Lets teams document FINAL usage explicitly instead of hiding eventual merge behavior.

What the First Useful Version Looks Like ​

The first useful version is one ClickHouse write user, one destination database, and one CDC-managed table that you query both normally and with FINAL. That proves the auth path and the read model together.

If you do not need CDC yet, keep the same secret-handling pattern anyway. The password belongs outside config whether the table is batch-loaded or CDC-managed.