Snowflake Connection

Infisical supports connecting to Snowflake using a Username and a Programmatic Access Token (PAT). PATs are scoped, revocable credentials that authenticate as a Snowflake user without exposing the user’s password.

Prerequisites

A Snowflake account with permission to create Programmatic Access Tokens.
The account identifier for your Snowflake instance, which combines your organization name and account name. You can find it in your Snowflake login URL (https://app.snowflake.com/orgName/accountName/#/account/users) or under Account Details in Snowsight.

Create a dedicated Snowflake user (or role) for Infisical rather than reusing a personal account. This keeps the connection’s blast radius small and makes it easy to rotate or revoke access independently.

Create a Snowflake Programmatic Access Token

Open Snowsight User Settings

In Snowsight, open the side bar menu and select Users & roles under Governance & Security. Snowflake User Profile

Create a new User

Click Create user in the top-right corner. Generate Programmatic Access Token

Create a network policy

Programmatic Access Tokens require an attached network policy that defines the IPs allowed to authenticate as this user. To create one, hover over Projects, click on Workspaces, and create a network policy. The snippet below creates one that allows access from any IP. Go into workspace

CREATE NETWORK POLICY INFISICAL_SYNC_POLICY
    ALLOWED_IP_LIST = ('0.0.0.0/0')
    COMMENT = 'Allow access from any IP';

ALTER USER INFISICAL set NETWORK_POLICY = 'INFISICAL_SYNC_POLICY';

Be careful with the IPs you allow in your network policy. Using 0.0.0.0/0 allows access from any IP address, which can be dangerous in production. Prefer restricting the list to only the IP ranges that should be allowed to authenticate (for example, your corporate NAT(s) and/or Infisical’s outbound IPs if you have them).

Configure user details and role

Provide a Username and assign a role. Then grant the role the privileges required for how you intend to use the connection. Configure User

To run the grant statements below, select the Projects tab and click on Workspaces to open the query editor. Go into workspace

Secret Syncs
Secret Rotations

The role must have permission to create and manage secrets in the target database. The following snippet grants the minimum privileges required for operations on specific tables and schemas.

-- Grant INFISICAL user access to SECRET_SYNC_TEST
CREATE ROLE IF NOT EXISTS INFISICAL_ROLE;
GRANT ROLE INFISICAL_ROLE TO USER INFISICAL; -- Change INFISICAL to be your user

GRANT ALL PRIVILEGES ON DATABASE SECRET_SYNC_TEST TO ROLE INFISICAL_ROLE;
GRANT ALL PRIVILEGES ON SCHEMA SECRET_SYNC_TEST.PUBLIC TO ROLE INFISICAL_ROLE;
GRANT OWNERSHIP ON ALL SECRETS IN SCHEMA SECRET_SYNC_TEST.PUBLIC TO ROLE INFISICAL_ROLE REVOKE CURRENT GRANTS; -- Transfers ownership
GRANT OWNERSHIP ON FUTURE SECRETS IN SCHEMA SECRET_SYNC_TEST.PUBLIC TO ROLE INFISICAL_ROLE REVOKE CURRENT GRANTS; -- Transfers ownership

If you select a custom role, note that secret ownership is enforced per object. Existing secrets in the target schema remain owned by their creator unless you transfer ownership. Infisical must use a role that owns every secret it manages (required for CREATE OR REPLACE SECRET and DROP SECRET). If the schema already has secrets, run the GRANT OWNERSHIP ON ALL SECRETS ... statement; always keep the GRANT OWNERSHIP ON FUTURE SECRETS ... statement.

For Snowflake User Key Pair rotation, the connection’s role must be able to alter the target user whose key pair will be rotated. Grant a role that can manage the user and assign it to your connection user:

-- create a role Infisical will use to manage the target user
CREATE ROLE IF NOT EXISTS INFISICAL_ROTATION_ROLE;

-- allow the role to alter the target user's RSA public key
GRANT OWNERSHIP ON USER MY_TARGET_USER TO ROLE INFISICAL_ROTATION_ROLE;

-- (optional) allow the role to create the target user if it does not exist yet
GRANT CREATE USER ON ACCOUNT TO ROLE INFISICAL_ROTATION_ROLE;

-- assign the role to the user backing your Snowflake Connection
GRANT ROLE INFISICAL_ROTATION_ROLE TO USER MY_CONNECTION_USER;

If the target user already exists, the connection’s role only needs privileges to alter it (e.g. OWNERSHIP on the user). If the user does not exist yet, the role additionally requires the CREATE USER privilege on the account.

To learn more about managing users and privileges in Snowflake, see their access control documentation.

Generate a Programmatic Access Token

Hover over Governance & Security and click on Users & roles. Select the user you want to use in Infisical. Open the Programmatic access tokens tab and click Generate new token. Give the token a descriptive name (e.g. infisical) and configure its expiration and role restrictions according to your security policy. Generate Programmatic Access Token

Copy the Token

Copy the generated token. Snowflake only displays it once — store it somewhere secure for the next step. Copy Programmatic Access Token

Copy the Snowflake Account

Copy the Account identifier. The fastest way is to read it from your Snowsight URL (https://app.snowflake.com/orgName/accountName/#/account/users), where the identifier is orgName-accountName.Alternatively, click your username in the bottom-left corner, open Account details, and copy the Account value from the Config File tab. Account details button

Create Snowflake Connection in Infisical

Infisical UI
API

Navigate to App Connections

In your Infisical dashboard, go to Organization Settings → App Connections. App Connections Tab

Select Snowflake Connection

Click Add Connection and choose Snowflake from the list of available connections. Select Snowflake Connection

Fill out Connection Form

Complete the form with:

A name for the connection (e.g. snowflake-prod)
An optional description
The Snowflake Account identifier (e.g. orgName-accountName)
The Snowflake Username (The name of the user that was created)
The Programmatic Access Token generated in the previous section

Connection Created

After clicking Create, Infisical validates the credentials by opening a connection to your Snowflake account. Once validated, your Snowflake Connection is ready to use. Snowflake Connection Created

Create a Snowflake connection via the API.

Sample request

Request

curl --request POST \
  --url https://app.infisical.com/api/v1/app-connections/snowflake \
  --header 'Content-Type: application/json' \
  --data '{
    "name": "my-snowflake-connection",
    "method": "username-and-token",
    "credentials": {
      "account": "xy12345.us-east-1",
      "username": "<YOUR-SNOWFLAKE-USERNAME>",
      "password": "<YOUR-PROGRAMMATIC-ACCESS-TOKEN>"
    }
  }'

Sample response

Response

{
  "appConnection": {
    "id": "e5d18aca-86f7-4026-a95e-efb8aeb0d8e6",
    "name": "my-snowflake-connection",
    "description": null,
    "version": 1,
    "orgId": "6f03caa1-a5de-43ce-b127-95a145d3464c",
    "createdAt": "2025-04-23T19:46:34.831Z",
    "updatedAt": "2025-04-23T19:46:34.831Z",
    "isPlatformManagedCredentials": false,
    "app": "snowflake",
    "method": "username-and-token",
    "credentials": {
      "account": "xy12345.us-east-1",
      "username": "<YOUR-SNOWFLAKE-USERNAME>"
    }
  }
}

Getting Started

Platform Reference

Connectivity

Authentication Methods

Self-host Infisical

Internals

Contributing

Snowflake Connection

Prerequisites

Create a Snowflake Programmatic Access Token

Create Snowflake Connection in Infisical

Sample request

Sample response

​Prerequisites

​Create a Snowflake Programmatic Access Token

​Create Snowflake Connection in Infisical

​Sample request

​Sample response

Prerequisites

Create a Snowflake Programmatic Access Token

Create Snowflake Connection in Infisical

Sample request

Sample response