Snowflake Profiles

Configure reusable Snowflake credentials once at the workspace level so connections do not re-enter account, warehouse, role, and OAuth client details every time. The Profiles tab on the Data Sources page is workspace-admin only.

Audience: IT (the enabler), workspace admins

What a profile is

A Snowflake profile is a workspace-scoped record that stores an account identifier, a default warehouse, optional default database, schema, and role, a query mutability default, and the OAuth client credentials that connect to Snowflake on a builder's behalf. New Snowflake connections pick a profile in the Create Snowflake connection dialog instead of re-entering these fields.

Why profiles are workspace-wide. New data sources land in the active team, but Snowflake profiles remain workspace-wide. One profile can power Snowflake connections across every team, which keeps credential rotation in a single place.

Who can manage profiles

Workspace admins (owners and admins) only. Non-admins land on an admin-access-required surface. The Profiles tab on the Data Sources page is hidden from team admins and members.

Create a profile

Open the Profiles tab

Navigate to Data Sources then Profiles. Click New profile. A workbench drawer opens with Guided setup at the top.

Run the Snowflake bootstrap SQL

Click Copy Snowflake SQL and run the script in Snowflake as ACCOUNTADMIN or a role with CREATE INTEGRATION. The script creates a Snowflake OAuth security integration whose redirect URI points at the platform's callback, then returns the integration's OAUTH_CLIENT_ID and OAUTH_CLIENT_SECRET as a JSON object.

Paste the Snowflake output

Paste the JSON returned by the final SELECT into Paste the Snowflake output. Click Apply output. The guided flow fills profile name, account, warehouse, role, OAuth client ID, and OAuth client secret. Database and Schema stay unset so projects can choose them later.

Set default connection settings

Open Default connection settings. Set Query mutability (defaults to read_only). Override Database, Schema, or Role when you want every connection that picks this profile to inherit a value. The platform refuses to save ACCOUNTADMIN as the default role; pick a less-privileged role.

Save

Click Create profile. The profile appears in the list with its account, warehouse, and a Read only or Read/write badge.

Assign a profile to a connection

In the Create Snowflake connection dialog, leave Start from a reusable workspace profile checked, pick the profile from Snowflake profile, name the connection, and authorize. The connection inherits the profile's account, warehouse, OAuth client, and (when set) database, schema, and role. Per-connection overrides for database, schema, and role are still available in the dialog.

Edit or remove a profile

Click a profile to open its drawer. Update fields and click Update profile. Leave OAuth client secret blank to keep the existing secret. Click Delete profile to remove a profile. Existing project connections that used the profile stay in place until reconfigured, but the deleted profile cannot be picked for new connections.

Common patterns

Per environment. Separate profiles for production, staging, and development. Each profile points at the right warehouse and role.
Per team or domain. Separate profiles for AP, AR, and GL so each profile's role can be scoped to that domain's data.
Read-only by default. Leave Query mutability at read_only for analytics connections. Create a separate read_write profile for the narrow set of workloads that genuinely write back.

Advanced OAuth settings

Open Advanced OAuth settings only when Snowflake needs custom authorization or token endpoints, a custom scope, or single-use refresh tokens. For most accounts the defaults are correct.

Common errors

ACCOUNTADMIN as default role rejected. Pick a less-privileged role. The platform refuses to save the most privileged role.
Paste validation failed. The pasted output must be a JSON object. The textarea highlights green when the output parses and red when it does not.
OAuth popup blocked. The browser blocked the authorization popup. Allow popups for the platform host and retry from the connection dialog.