Connect Snowflake

Set up a read-only role, generate a key pair, and add a Snowflake warehouse to Arcus.

Last updated 2026-05-09

Arcus reads from Snowflake using a read-only role with a key-pair authentication. We never store passwords, never use a login user, and never write to your warehouse. This guide walks you through the Snowflake-side setup, then the Arcus-side connection form.

You'll need an account admin for the Snowflake-side steps, plus about 15 minutes.

What Arcus needs

A read-only role scoped to the schema you want to expose.
A service user with that role assigned.
An RSA key pair for key-pair auth (no passwords in our database).
Network access from Vercel egress IPs to your Snowflake account (most accounts allow this by default).

Snowflake-side setup

Run these as ACCOUNTADMIN or someone with equivalent grant privileges. Replace MY_DB.ANALYTICS with the database and schema you want Arcus to read.

-- 1. Create a read-only role
CREATE ROLE ARCUS_READER;

-- 2. Grant warehouse usage (use a small XS warehouse — Arcus queries are cheap)
CREATE WAREHOUSE IF NOT EXISTS ARCUS_WH WITH
  WAREHOUSE_SIZE = 'X-SMALL'
  AUTO_SUSPEND = 60
  AUTO_RESUME = TRUE;
GRANT USAGE ON WAREHOUSE ARCUS_WH TO ROLE ARCUS_READER;

-- 3. Grant read on the schema
GRANT USAGE ON DATABASE MY_DB TO ROLE ARCUS_READER;
GRANT USAGE ON SCHEMA MY_DB.ANALYTICS TO ROLE ARCUS_READER;
GRANT SELECT ON ALL TABLES IN SCHEMA MY_DB.ANALYTICS TO ROLE ARCUS_READER;
GRANT SELECT ON FUTURE TABLES IN SCHEMA MY_DB.ANALYTICS TO ROLE ARCUS_READER;
GRANT SELECT ON ALL VIEWS IN SCHEMA MY_DB.ANALYTICS TO ROLE ARCUS_READER;
GRANT SELECT ON FUTURE VIEWS IN SCHEMA MY_DB.ANALYTICS TO ROLE ARCUS_READER;

-- 4. Create the service user
CREATE USER ARCUS_SVC
  DEFAULT_ROLE = ARCUS_READER
  DEFAULT_WAREHOUSE = ARCUS_WH
  MUST_CHANGE_PASSWORD = FALSE
  TYPE = SERVICE;
GRANT ROLE ARCUS_READER TO USER ARCUS_SVC;

Generate a key pair

Locally, generate an unencrypted PKCS#8 key (Snowflake's required format):

openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out arcus_key.p8 -nocrypt
openssl rsa -in arcus_key.p8 -pubout -out arcus_key.pub

You'll get two files. Open arcus_key.pub and copy everything between the -----BEGIN PUBLIC KEY----- lines as a single string.

Assign the public key to the service user:

ALTER USER ARCUS_SVC SET RSA_PUBLIC_KEY='MIIBIjANBgkqhkiG...';

Verify the fingerprint:

DESC USER ARCUS_SVC;
-- look for RSA_PUBLIC_KEY_FP — it should match what `openssl rsa -in arcus_key.p8 -pubout -outform DER | openssl dgst -sha256 -binary | openssl base64` produces

Keep the private key (arcus_key.p8) safe — you'll paste its contents into Arcus next, then you can delete the local copy.

Network policy (if you have one)

If your Snowflake account has a network policy, allowlist Vercel's egress range. Email hello@usearcus.ai if you need our current egress IPs — we keep them documented privately so we can rotate if needed.

If you don't have a network policy, this step is a no-op.

Arcus-side setup

In Arcus, open Settings → Connections → Add a connection and pick Snowflake. Fill in:

Connection name — something readable, like "Production warehouse".
Account identifier — the part before .snowflakecomputing.com in your URL. Format is usually <org>-<account> (e.g. xy12345-acme_prod).
Warehouse — ARCUS_WH.
Database — MY_DB.
Schema — ANALYTICS (optional; if blank, Arcus discovers all schemas the role can see).
Username — ARCUS_SVC.
Private key — paste the entire contents of arcus_key.p8, including the -----BEGIN PRIVATE KEY----- headers.

Click Save. Arcus runs SELECT 1 to verify the credentials and shows a green Connected badge if everything's wired correctly.

Common errors

JWT token is invalid — the public key fingerprint in Snowflake doesn't match the private key you pasted. Re-run the openssl commands above, re-assign the public key with ALTER USER, and confirm DESC USER shows the new fingerprint.

Object 'MY_DB.ANALYTICS' does not exist or not authorized — the role doesn't have grants on that schema. Re-run the GRANT SELECT statements. Pay attention to FUTURE TABLES — without it, tables created tomorrow won't be visible.

Failed to connect: tcp dial error — network policy is blocking us. Allowlist our egress IPs.

Test the connection

After connecting, click Discover schema. Arcus lists every dataset/schema/table the role can see. If you don't see a table you expected, the role is missing a grant — fix it Snowflake-side, then click Refresh schema.

Cost

Arcus queries small. A typical question reads under 1 GB. We use the warehouse you assign, so the cost goes to your bill — your Arcus subscription doesn't include Snowflake compute.

For cost monitoring, see Audit log — every query is logged with bytes scanned and credits used.

Connect BigQuery