Connect Snowflake

Set up a Snowflake connection with key-pair authentication — required account fields and a least-privilege warehouse role.

This page covers connecting Snowflake to Flax. Add the connection from the Data page at /app/data.

#Authentication

Flax authenticates to Snowflake with key-pair (RSA) auth, not a password — Snowflake has deprecated password sign-in for programmatic access. Generate an RSA key pair, assign the public key to the Snowflake user, and give Flax the private key.

openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out flax_key.p8 -nocrypt
openssl rsa -in flax_key.p8 -pubout -out flax_key.pub

Then set the public key on the user in Snowflake:

ALTER USER flax_svc SET RSA_PUBLIC_KEY='MIIBIj…';

#Required fields

Field Description
account Your Snowflake account identifier (used to build https://<account>.snowflakecomputing.com).
user The Snowflake user the key pair belongs to.
warehouse Virtual warehouse used to run queries.
database Default database to query.
private_key The PEM private key, stored as the connection secret and encrypted at rest.

#Least-privilege credentials

Create a dedicated role and grant it read-only access plus the compute warehouse:

CREATE ROLE flax_reader;
GRANT USAGE ON WAREHOUSE analytics_wh TO ROLE flax_reader;
GRANT USAGE ON DATABASE analytics TO ROLE flax_reader;
GRANT USAGE ON ALL SCHEMAS IN DATABASE analytics TO ROLE flax_reader;
GRANT SELECT ON ALL TABLES IN DATABASE analytics TO ROLE flax_reader;
GRANT ROLE flax_reader TO USER flax_svc;

Size the warehouse for interactive analytics and let it auto-suspend to control cost — Flax pushes each query down to Snowflake (ADR-0004), so all compute is billed to this warehouse.