ClickHouse "Authentication failed" (AUTHENTICATION_FAILED) in CI

By Kaveh Alemi·Latchkey

ClickHouse rejects a connection with "Authentication failed" (error code 516) when the supplied user and password do not match. In CI this is usually a mismatch between the container env that set the password and the client credentials.

What this error means

A query fails with "Code: 516. DB::Exception: user: Authentication failed: password is incorrect, or there is no user with such name. (AUTHENTICATION_FAILED)".

Code: 516. DB::Exception: default: Authentication failed: password is incorrect,
or there is no user with such name. (AUTHENTICATION_FAILED)

Common causes

Client credentials do not match the container env

The server was started with CLICKHOUSE_PASSWORD set, but the client connects with no password or a different one.

Using the default user when a password is required

Setting a password for default means an empty-password connection is now rejected.

How to fix it

Set the password env and use it in the client

1. Define CLICKHOUSE_PASSWORD on the service container.
2. Pass the same user and password to the client and app.
3. Keep both in one secret to avoid drift.

services:
  clickhouse:
    image: clickhouse/clickhouse-server:24.8
    env:
      CLICKHOUSE_USER: app
      CLICKHOUSE_PASSWORD: testpass
    ports: ['8123:8123', '9000:9000']

Pass matching credentials to the client

Provide the user and password explicitly when querying.

clickhouse-client --user app --password testpass --query "SELECT 1"

How to prevent it

• Set credentials once and reuse them in client and app.
• Store the password in a CI secret.
• Do not assume an empty password when one is configured.

Frequently asked questions

Related guides

References

• GitHub Actions documentation