Snowflake

Connect Snowflake to Felt to map tables and views. Use key-pair or programmatic access token authentication.

Available on the Business and Enterprise plans. Compare plans

Connect Snowflake to add a database's tables and views to maps or query them with SQL.

Connect Snowflake

Create a read-only user for Felt with one of the supported authentication methods. Then follow the steps in Add a source and select Snowflake. If your Snowflake account uses network policies, allow Felt's IP addresses.

In Connection, fill in these fields.

Field	Required	What to enter
Account ID	Yes	Your Snowflake account identifier, such as myorg-account123.
Database	Yes	The name of the database.
Username	Yes	The Snowflake user you created for Felt, not your Felt login.
Schema	No	One schema to read. Leave it empty to read all schemas.
Role	No	The role Felt uses. Leave it empty to use the user's default role.
Warehouse	No	The warehouse Felt uses for queries. Leave it empty to use the user's default warehouse.

Supported authentication methods

Snowflake sources support key-pair authentication and programmatic access tokens. In Credentials, select the method you want as the Authentication type.

Since November 2025, Snowflake has blocked programmatic access with a username and password. If a source still uses Password, switch it to one of these methods in the source's Settings so Felt can keep reading from it.

Key-pair authentication

Snowflake key-pair authentication pairs a public key on a Snowflake user with a private key that you upload to Felt.

1. In a terminal, create a key pair. Snowflake recommends an encrypted private key, protected by a passphrase.

   # Encrypted private key (add the -nocrypt flag for an unencrypted key with no passphrase)
   openssl genrsa 2048 | openssl pkcs8 -topk8 -v2 des3 -inform PEM -out snowflake_rsa_key.p8
   
   # Public key
   openssl rsa -in snowflake_rsa_key.p8 -pubout -out snowflake_rsa_key.pub

2. In a Snowflake SQL worksheet, create a read-only role with access to the warehouse, database, schemas, and tables you want to use in Felt. Replace MY_DATABASE and MY_WAREHOUSE with yours.

   CREATE ROLE IF NOT EXISTS FELT_READONLY_ROLE;
   
   GRANT USAGE ON DATABASE MY_DATABASE TO ROLE FELT_READONLY_ROLE;
   GRANT USAGE ON WAREHOUSE MY_WAREHOUSE TO ROLE FELT_READONLY_ROLE;
   GRANT USAGE ON ALL SCHEMAS IN DATABASE MY_DATABASE TO ROLE FELT_READONLY_ROLE;
   
   GRANT SELECT ON ALL TABLES IN DATABASE MY_DATABASE TO ROLE FELT_READONLY_ROLE;
   GRANT SELECT ON ALL VIEWS IN DATABASE MY_DATABASE TO ROLE FELT_READONLY_ROLE;
   GRANT SELECT ON ALL MATERIALIZED VIEWS IN DATABASE MY_DATABASE TO ROLE FELT_READONLY_ROLE;
   GRANT SELECT ON ALL DYNAMIC TABLES IN DATABASE MY_DATABASE TO ROLE FELT_READONLY_ROLE;
   
   -- Cover schemas, tables, and views created later
   GRANT USAGE ON FUTURE SCHEMAS IN DATABASE MY_DATABASE TO ROLE FELT_READONLY_ROLE;
   GRANT SELECT ON FUTURE TABLES IN DATABASE MY_DATABASE TO ROLE FELT_READONLY_ROLE;
   GRANT SELECT ON FUTURE VIEWS IN DATABASE MY_DATABASE TO ROLE FELT_READONLY_ROLE;
   GRANT SELECT ON FUTURE MATERIALIZED VIEWS IN DATABASE MY_DATABASE TO ROLE FELT_READONLY_ROLE;
   GRANT SELECT ON FUTURE DYNAMIC TABLES IN DATABASE MY_DATABASE TO ROLE FELT_READONLY_ROLE;

   The ON ALL grants cover only what exists today. The ON FUTURE grants give Felt access to schemas and tables you create later, so they appear in the source at its next list refresh without new grants. If a schema has its own future grants, Snowflake uses those instead, so add the grants to that schema too.

3. Create a service user with the public key and grant it the role. Before pasting the public key, remove its header and footer lines (starting with ---) and all line breaks.

   CREATE OR REPLACE USER FELT_READONLY_USER
       DEFAULT_ROLE = 'FELT_READONLY_ROLE'
       TYPE = SERVICE DEFAULT_SECONDARY_ROLES = ('ALL')
       RSA_PUBLIC_KEY='MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAhgUzdrUxT7F5w1A6CVslBZ7dS37JunCnJxHkmnVk26FO6jl4yVWuFrk4b31NrnErcaKXeQqR18burBcz73xgDwZL/wplBLk1AZb76A/xYUlbS1L0+vKyuOPOJo8l1n9JyJ7UiyVdeVMCeFQIaDKYErzvCJ/9BO8+fNPPJr2AdAYHHFOw9HnfqyHA4j3jYdk2A9f8iYkEV5iAVdMyn6/iXqnfZDbcwXqgvfSPrrk56HrAZtSAhiW3VFhGzTnJq5ekSDBvK+fPoykdfnceV5nOQJSC41aFdsR9mUqVdbQsh78B4Ff1g+1ujqPjp+GJa8YaMOaYpQP43AkWBGjaS87F+wIDAQAB'
       COMMENT = 'Service User with read-only access and key-pair authentication';
   
   GRANT ROLE FELT_READONLY_ROLE TO USER FELT_READONLY_USER;

4. In Felt, select Key pair and upload the private key file, such as snowflake_rsa_key.p8, to Private key. Felt accepts .pem, .key, .p8, and .ppk files. If the key is encrypted, enter its Passphrase.

Programmatic access token

A Snowflake programmatic access token (PAT) is a long-lived token for one user. Snowflake creates a PAT only for a user bound to a network policy, so add Felt's IP addresses to that policy. In Felt, select Programmatic access token and paste the token into Token. See Snowflake's guide to programmatic access tokens.