Connectors.

Connect a service

Open Connectors in the dashboard and choose a provider; on its connect page, pick a box and paste the credential. Prized creates an encrypted secret with the provider host allowlist and mounts it under the conventional env name.

The box sees a placeholder in that env variable. The broker substitutes the real value only when an HTTPS request sends that placeholder unchanged in a request header to the allowed host.

ClickHouse

Enter the HTTPS endpoint, such as https://abc.clickhouse.cloud:8443, and the password. Keep the endpoint, username, and database in your project's normal non-secret config. The connector mounts only the password.

A direct HTTP-interface check looks like this:

curl -sS "$CLICKHOUSE_URL/?database=$CLICKHOUSE_DATABASE" \
  -H "X-ClickHouse-User: $CLICKHOUSE_USER" \
  -H "X-ClickHouse-Key: $CLICKHOUSE_PASSWORD" \
  --data-binary 'SELECT 1'

Plain HTTP endpoints are refused. A brokered password is never sent over cleartext transport.

Client compatibility

The client must send the env value unchanged in an HTTPS request header. Most bearer-token SDKs do this. A client that transforms the value first, for example by building a Basic-auth base64 string inside the box, prevents exact placeholder substitution. Prefer a raw token header, or store the already transformed header value as the connector credential when the upstream supports it.

Rotate or remove

Connectors use the same broker as Secrets. Rotate or delete the generated credential under Secrets. Open the box's Secrets tab to inspect or remove its env binding.