Reset User Passwords

Reset ClickHouse user passwords using the Private API.

Prerequisites

ClickHouse Private API installed and accessible (e.g., via port-forward to http://localhost:8080/)
At least one ClickHouse cluster deployed (this guide uses default-xx-01)

1. Generate a Hashed Password

Hash the new password using SHA-256 and base64-encode the result:

PASSWORD='My super secret p@$$w0rd'
HASHED_PASSWORD=$(echo -n "$PASSWORD" | shasum -a 256 | awk '{printf $1}' | base64)

2. Create the Request Body

Create a JSON file with the hashed password:

{
  "user_hashed_password": "<base64-encoded-sha256-hash>",
  "hashing_function": "sha256",
  "username": "default"
}

Save this as password_reset.json.

Field	Required	Default	Description
`user_hashed_password`	Yes	—	Base64-encoded hash of the new password
`hashing_function`	No	`sha256`	Hashing algorithm used
`username`	No	`default`	Username to reset the password for

3. Send the Request

curl -X POST "http://localhost:8080/api/v1/instances/default-xx-01/reset-user-password" \
    -H "Content-Type: application/json" \
    --data-binary "@password_reset.json"

A successful response:

{
  "message": "User password reset successfully"
}

4. Verify the Change

The password reset takes effect after the operator processes the change. Verify by connecting to the cluster with the new password. You can also monitor the operation via the status endpoint:

curl "http://localhost:8080/api/v1/instances/default-xx-01/status"

Limitation for Compute-Compute Separation

Password resets cannot be performed on child instances. To reset the password for a child instance, reset it on the parent instance instead.

ClickHouse Cloud

Bring Your Own Cloud

ClickHouse Private

Prerequisites

1. Generate a Hashed Password

2. Create the Request Body

3. Send the Request

4. Verify the Change

Limitation for Compute-Compute Separation

​Prerequisites

​1. Generate a Hashed Password

​2. Create the Request Body

​3. Send the Request

​4. Verify the Change

​Limitation for Compute-Compute Separation

Prerequisites

1. Generate a Hashed Password

2. Create the Request Body

3. Send the Request

4. Verify the Change

Limitation for Compute-Compute Separation