> For the complete documentation index, see [llms.txt](https://help.felt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.felt.com/upload-anything/data-sources/snowflake.md). # Snowflake Connect Snowflake to Felt to map tables and views. Use key-pair or programmatic access token authentication. {% hint style="success" %} Available on the Business and Enterprise plans. [Compare plans](https://felt.com/pricing#compare) {% endhint %} Connect [Snowflake](https://www.snowflake.com/en/) to add a database's tables and views to maps or query them with [SQL](/upload-anything/sql-queries.md). {% embed url="" %} ## Connect Snowflake Create a read-only user for Felt with one of the [supported authentication methods](#supported-authentication-methods). Then follow the steps in [Add a source](/upload-anything/data-sources/add-a-source.md#connect-a-source) and select **Snowflake**. If your Snowflake account uses network policies, [allow Felt's IP addresses](/upload-anything/data-sources/add-a-source.md#allow-felts-ip-addresses). In **Connection**, fill in these fields. | Field | Required | What to enter | | ---------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------- | | Account ID | Yes | Your Snowflake [account identifier](https://docs.snowflake.com/en/user-guide/admin-account-identifier), such as `myorg-account123`. | | Database | Yes | The name of the database. | | Username | Yes | The Snowflake user you created for Felt, not your Felt login. | | Schema | No | One schema to read. Leave it empty to read all schemas. | | Role | No | The role Felt uses. Leave it empty to use the user's default role. | | Warehouse | No | The warehouse Felt uses for queries. Leave it empty to use the user's default warehouse. | ## Supported authentication methods Snowflake sources support key-pair authentication and programmatic access tokens. In **Credentials**, select the method you want as the **Authentication type**. {% hint style="danger" %} Since November 2025, Snowflake has blocked programmatic access with a username and password. If a source still uses **Password**, switch it to one of these methods in the source's **Settings** so Felt can keep reading from it. {% endhint %} ### Key-pair authentication Snowflake [key-pair authentication](https://docs.snowflake.com/en/user-guide/key-pair-auth) pairs a public key on a Snowflake user with a private key that you upload to Felt. 1. In a terminal, create a key pair. Snowflake recommends an encrypted private key, protected by a passphrase. ```bash # Encrypted private key (add the -nocrypt flag for an unencrypted key with no passphrase) openssl genrsa 2048 | openssl pkcs8 -topk8 -v2 des3 -inform PEM -out snowflake_rsa_key.p8 # Public key openssl rsa -in snowflake_rsa_key.p8 -pubout -out snowflake_rsa_key.pub ``` 2. In a Snowflake SQL worksheet, create a read-only role with access to the warehouse, database, schemas, and tables you want to use in Felt. Replace `MY_DATABASE` and `MY_WAREHOUSE` with yours. ```sql CREATE ROLE IF NOT EXISTS FELT_READONLY_ROLE; GRANT USAGE ON DATABASE MY_DATABASE TO ROLE FELT_READONLY_ROLE; GRANT USAGE ON WAREHOUSE MY_WAREHOUSE TO ROLE FELT_READONLY_ROLE; GRANT USAGE ON ALL SCHEMAS IN DATABASE MY_DATABASE TO ROLE FELT_READONLY_ROLE; GRANT SELECT ON ALL TABLES IN DATABASE MY_DATABASE TO ROLE FELT_READONLY_ROLE; GRANT SELECT ON ALL VIEWS IN DATABASE MY_DATABASE TO ROLE FELT_READONLY_ROLE; GRANT SELECT ON ALL MATERIALIZED VIEWS IN DATABASE MY_DATABASE TO ROLE FELT_READONLY_ROLE; GRANT SELECT ON ALL DYNAMIC TABLES IN DATABASE MY_DATABASE TO ROLE FELT_READONLY_ROLE; -- Cover schemas, tables, and views created later GRANT USAGE ON FUTURE SCHEMAS IN DATABASE MY_DATABASE TO ROLE FELT_READONLY_ROLE; GRANT SELECT ON FUTURE TABLES IN DATABASE MY_DATABASE TO ROLE FELT_READONLY_ROLE; GRANT SELECT ON FUTURE VIEWS IN DATABASE MY_DATABASE TO ROLE FELT_READONLY_ROLE; GRANT SELECT ON FUTURE MATERIALIZED VIEWS IN DATABASE MY_DATABASE TO ROLE FELT_READONLY_ROLE; GRANT SELECT ON FUTURE DYNAMIC TABLES IN DATABASE MY_DATABASE TO ROLE FELT_READONLY_ROLE; ``` The `ON ALL` grants cover only what exists today. The `ON FUTURE` grants give Felt access to schemas and tables you create later, so they appear in the source at its next list refresh without new grants. If a schema has its own future grants, Snowflake uses those instead, so add the grants to that schema too. 3. Create a service user with the public key and grant it the role. Before pasting the public key, remove its header and footer lines (starting with `---`) and all line breaks. ```sql CREATE OR REPLACE USER FELT_READONLY_USER DEFAULT_ROLE = 'FELT_READONLY_ROLE' TYPE = SERVICE DEFAULT_SECONDARY_ROLES = ('ALL') RSA_PUBLIC_KEY='MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAhgUzdrUxT7F5w1A6CVslBZ7dS37JunCnJxHkmnVk26FO6jl4yVWuFrk4b31NrnErcaKXeQqR18burBcz73xgDwZL/wplBLk1AZb76A/xYUlbS1L0+vKyuOPOJo8l1n9JyJ7UiyVdeVMCeFQIaDKYErzvCJ/9BO8+fNPPJr2AdAYHHFOw9HnfqyHA4j3jYdk2A9f8iYkEV5iAVdMyn6/iXqnfZDbcwXqgvfSPrrk56HrAZtSAhiW3VFhGzTnJq5ekSDBvK+fPoykdfnceV5nOQJSC41aFdsR9mUqVdbQsh78B4Ff1g+1ujqPjp+GJa8YaMOaYpQP43AkWBGjaS87F+wIDAQAB' COMMENT = 'Service User with read-only access and key-pair authentication'; GRANT ROLE FELT_READONLY_ROLE TO USER FELT_READONLY_USER; ``` 4. In Felt, select **Key pair** and upload the private key file, such as `snowflake_rsa_key.p8`, to **Private key**. Felt accepts `.pem`, `.key`, `.p8`, and `.ppk` files. If the key is encrypted, enter its **Passphrase**. ### Programmatic access token A Snowflake programmatic access token (PAT) is a long-lived token for one user. Snowflake creates a PAT only for a user bound to a network policy, so add Felt's IP addresses to that policy. In Felt, select **Programmatic access token** and paste the token into **Token**. See [Snowflake's guide to programmatic access tokens](https://docs.snowflake.com/en/user-guide/programmatic-access-tokens). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://help.felt.com/upload-anything/data-sources/snowflake.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.