Create a scoped ClickHouse Cloud API key and authenticate to the Cloud API at https://api.clickhouse.cloud/v1 with HTTP Basic auth

Documented steps

1. Read the key-creation doc: https://clickhouse.com/docs/cloud/manage/openapi. In the ClickHouse Cloud console open the 'API Keys' tab and click 'Create Key', or use an existing admin-scoped key to create one programmatically.
2. Choose the key's permissions. The `roles` array (admin / developer / query_endpoints) is DEPRECATED; prefer `assignedRoleIds`, an array of role UUIDs. Fetch valid IDs first with GET /v1/organizations/{organizationId}/roles.
3. Create programmatically: POST /v1/organizations/{organizationId}/keys with body {"name":"ci-deploy-key","expireAt":"2026-12-31T00:00:00Z","state":"enabled","assignedRoleIds":["<role-uuid>"],"ipAccessList":[{"source":"203.0.113.0/24","description":"office network"}]}. `expireAt` omitted or null means the key never expires; `state` defaults to 'enabled'.
4. curl -s -u "$CH_ADMIN_ID:$CH_ADMIN_TOKEN" -X POST https://api.clickhouse.cloud/v1/organizations/<organizationId>/keys -H 'Content-Type: application/json' -d '{"name":"ci-deploy-key","assignedRoleIds":["<role-uuid>"]}'
5. The response returns the ApiKey object plus top-level key-ID and key-secret fields. Those two credential values appear only in this response (and only when you did not supply your own `hashData`). Store them in a secret manager immediately - there is no retrieval endpoint.
6. Discover your organizationId before scoping further calls: GET /v1/organizations returns the organization(s) the key can see, each with an `id` UUID. curl -s -u "$KEY_ID:$KEY_SECRET" https://api.clickhouse.cloud/v1/organizations
7. Authenticate every subsequent call with HTTP Basic auth - the key ID is the user component and the key secret is the pass component (OpenAPI securityScheme `basicAuth`, scheme 'basic'). There is no bearer-token exchange step.
8. Optionally restrict the key to specific source IPs/CIDRs with the `ipAccessList` array on POST or PATCH of the key. This restricts Cloud API access using that key; it is separate from a service's own ipAccessList, which governs database connections.
9. Rotate or re-scope later with PATCH /v1/organizations/{organizationId}/keys/{keyId} (name, expireAt, state, assignedRoleIds, ipAccessList). Remove with DELETE on the same path.
10. Respect the documented limits: 10 requests per 10-second window per API key, and a maximum of 100 API keys per organization. Higher limits require contacting ClickHouse support (see https://clickhouse.com/docs/cloud/manage/api/api-overview).