# Connect Snowflake

> Set up a Snowflake connection with key-pair authentication — required account fields and a least-privilege warehouse role.

*[View this page in the Flax docs](https://flax-analytics.com/docs/connections/snowflake)*

This page covers connecting Snowflake to Flax. Add the connection from the **Data** page at [/app/data](/app/data).

## Authentication

Flax authenticates to Snowflake with **key-pair (RSA) auth**, not a password — Snowflake has deprecated password sign-in for programmatic access. Generate an RSA key pair, assign the public key to the Snowflake user, and give Flax the private key.

```bash
openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out flax_key.p8 -nocrypt
openssl rsa -in flax_key.p8 -pubout -out flax_key.pub
```

Then set the public key on the user in Snowflake:

```sql
ALTER USER flax_svc SET RSA_PUBLIC_KEY='MIIBIj…';
```

## Required fields

| Field | Description |
| --- | --- |
| `account` | Your Snowflake account identifier (used to build `https://<account>.snowflakecomputing.com`). |
| `user` | The Snowflake user the key pair belongs to. |
| `warehouse` | Virtual warehouse used to run queries. |
| `database` | Default database to query. |
| `private_key` | The PEM private key, stored as the connection secret and encrypted at rest. |

## Least-privilege credentials

Create a dedicated role and grant it read-only access plus the compute warehouse:

```sql
CREATE ROLE flax_reader;
GRANT USAGE ON WAREHOUSE analytics_wh TO ROLE flax_reader;
GRANT USAGE ON DATABASE analytics TO ROLE flax_reader;
GRANT USAGE ON ALL SCHEMAS IN DATABASE analytics TO ROLE flax_reader;
GRANT SELECT ON ALL TABLES IN DATABASE analytics TO ROLE flax_reader;
GRANT ROLE flax_reader TO USER flax_svc;
```

Size the warehouse for interactive analytics and let it auto-suspend to control cost — Flax pushes each query down to Snowflake (ADR-0004), so all compute is billed to this warehouse.

## Related

- [Connecting data](/docs/connections/overview)
- [Connection security](/docs/connections/security)
- [Caching & performance](/docs/connections/caching-and-performance)