Snowflake

Connect Snowflake so Projects can query governed warehouse data. Snowflake is special-cased in the platform with a dedicated dialog and a workspace-level Snowflake Profiles tab.

Audience: IT (the enabler)

Capability profile

Read-only by design. The platform reads from Snowflake for the Projects that attach it, and each Project's own access settings decide which tables it may read or change; query mutability defaults to read_only for new connections, and the role you connect with should be a least-privilege analyst role. Set read_write only when a workload genuinely needs to write back.

Who can connect this

Workspace admins and the active team's admin. Non-admins see a hard-block surface that names the admins who can help.

What you need

A Snowflake account identifier: your organization and account names separated by a hyphen, for example myorg-myaccount.
A warehouse (for example ANALYTICS_WH), an optional default database and schema, and a least-privilege role (for example ANALYST). The platform refuses to save ACCOUNTADMIN.
For a User connection, a Snowflake OAuth security integration that issues refresh tokens. The Profiles tab generates the bootstrap SQL for you.
For a Service connection, a Snowflake service user and one of these credentials:
- Key pair: the PEM private key that matches the public key set on the user, plus its passphrase if the key is encrypted.
- Access token: a programmatic access token for the user. Restrict it to one role in Snowflake.

A service user keeps agents and automations working when the person who set up the connection is away. User accounts sign in with OAuth, where Snowflake handles the password and MFA prompts.

Profile-first setup. Workspace profiles apply to User connections. When a profile exists, the Snowflake dialog defaults to "Start from a reusable workspace profile". The Profiles article walks through creating one. Reach for manual OAuth in this dialog only when a connection needs account-specific credentials that should not be shared across the workspace.

Connect Snowflake

Open the Snowflake catalog tile

On the Data Sources page's Catalog tab, click Connect on the Snowflake tile.

Choose how the connection signs in

In the Create Snowflake connection dialog, pick a User type and a Sign-in method:

User with Sign in with Snowflake (OAuth). Queries run as the Snowflake person who signs in. They sign in again when access expires.
Service with Key pair or Access token. Queries run as the Snowflake user you enter. Use a service user with a role limited to the data agents need.

User type in this dialog does not change the user type configured in Snowflake.

Pick a profile or open manual OAuth (User)

For a User connection, leave Start from a reusable workspace profile checked and pick a profile from Snowflake profile. To bypass profiles, uncheck the box and fill Account, Warehouse, OAuth client ID, and OAuth client secret directly.

Enter the service credentials (Service)

For a Service connection, fill Account, Warehouse, and User (the Snowflake user this connection signs in as). For Key pair, paste the PEM key into Private key and enter Private key passphrase. Leave the passphrase blank when the key is not encrypted. For Access token, paste the programmatic access token into Access token. Snowflake access tokens expire, so replace the token before its expiry date.

Set defaults

Name the connection in Connection name (admins see this in the Connected tab). Leave Database, Schema, and Role blank to inherit the profile's defaults, or override per connection.

Authorize or save

For a User connection, click Connect with profile or Open OAuth popup. Snowflake's authorization page appears in a popup; sign in and grant the requested scopes. The platform stores the refresh token and saves the connection.

For a Service connection, click Save connection. The platform tests the connection with these details before saving it.

Verify

Open the connection's drawer from the Connected tab. Click Run test to round-trip a query. The Status section shows Last sync and Last test; the Readiness tiles show schemas, relations, and profiled counts as discovery progresses.

Renew or replace credentials

Open the connection's drawer from the Connected tab and go to Settings.

User connections show Reconnect. Click it to renew the connection's Snowflake sign-in.
Service connections show Edit. Click it to open the Replace Snowflake credentials dialog.

In Replace Snowflake credentials, enter a new Access token, or a new Private key with its Private key passphrase, and click Save credentials. The current credentials stay in use until you save. Saving replaces all stored credentials for the connection, so leave the passphrase blank only when the new key is not encrypted. The dialog keeps the connection's sign-in method, account, warehouse, user, database, schema, and role. After saving, click Test to check the connection before you retire the previous credential in Snowflake. Replacing the credentials here does not revoke the old key or token in Snowflake.

Required Snowflake privileges

The connecting role needs at least:

USAGE on the warehouse.
USAGE on the database and any schemas the role should see.
SELECT on the tables and views in scope.
For User connections, USAGE on the OAuth security integration that issues the refresh token.

Grant only what each connection needs. Profiles let you keep a single least-privilege role per environment.

Common errors

Invalid account identifier. Use your organization and account names separated by a hyphen, for example myorg-myaccount. The dialog placeholder shows the expected shape.
ACCOUNTADMIN cannot be saved as the default role. The platform refuses to save it on a profile. Pick a less-privileged role.
OAuth client X is not authorized. The Snowflake OAuth integration is missing or its OAUTH_REDIRECT_URI does not match the platform callback. Re-run the bootstrap SQL from the Profiles tab.
Warehouse not accessible. The role lacks USAGE on the warehouse. Grant it and click Run test again.
Empty Readiness tiles after Connect. Discovery runs in phases (Structure, Profile bootstrap, Profile backlog). Watch the Status section; the badge moves from Bootstrapping to Ready when the first pass completes.