Snowflake
Connect Snowflake to explore databases and tables, run SQL, manage warehouses and tasks, and use Cortex AI on your data.
You paste two values into PopMCP: your account identifier and a programmatic access token. A token belongs to one account, so there is nothing else to pick.
- Setup time
- 3 min
- Auth
- API credentials
- API base URL
- https://{orgname}-{account_name}.snowflakecomputing.com
- Rate limits
- Snowflake does not publish request-rate numbers. Over a limit it answers 429, and PopMCP retries briefly. What limits you in practice is warehouse size and concurrency, and your credits.
Before you begin
- A Snowflake login. Tokens work on every edition, and you do not need an admin to make one for yourself
- A role that can do what the AI should do. A token restricted to a read-only role is the safest start
- A warehouse that role can use, because SQL runs on a warehouse and uses credits while it runs
- If your user is not covered by a network policy, an admin to run one short block of SQL, or a private key instead (see step 4)
Get your credentials
Copy your account identifier
Sign in to Snowsight at app.snowflake.com. Open the account selector at the bottom of the left menu and choose View account details. Copy the Account identifier, which looks like MYORG-MYACCOUNT. The address of your Snowsight page works too.
Home
Open your user and start a new token
In the left menu choose Governance & security, then Users & roles, then select your user. Under Programmatic access tokens choose Generate new token. You need no special privilege to make a token for yourself.
ANNA
Programmatic access tokens
Name the token, set how long it lasts, and pick a role
Give it a name such as POPMCP: letters, numbers and underscores only. Set Expires in to more than the 15 day default, up to 365 days, because the connection stops when the token expires. Choose One specific role (recommended) and pick the role the AI should use: it can never go beyond that role. Choose Generate.
ANNA
Programmatic access tokens
Copy the token, and allow it if your user has no network policy
Copy the token now: Snowflake shows it once. By default Snowflake only accepts a person's token from a user covered by a network policy. If PopMCP says a network policy is required in the next step, ask an admin to run this in a SQL worksheet, with your username in the last line. It lets your token work without a network policy, and any policy you do have still applies. The Bypass requirement for network policy option in Snowsight's More options menu is temporary, so it is not enough for a lasting connection.
USE ROLE ACCOUNTADMIN; CREATE DATABASE IF NOT EXISTS POPMCP_ADMIN; CREATE AUTHENTICATION POLICY IF NOT EXISTS POPMCP_ADMIN.PUBLIC.TOKEN_POLICY PAT_POLICY = (NETWORK_POLICY_EVALUATION = ENFORCED_NOT_REQUIRED); ALTER USER ANNA SET AUTHENTICATION POLICY POPMCP_ADMIN.PUBLIC.TOKEN_POLICY;
A user who already has an authentication policy keeps only one, so an admin should add the same setting to that policy instead.
ANNA
Programmatic access tokens
Paste both into PopMCP
In PopMCP, paste the identifier into Account identifier and the token into Access token, then connect. PopMCP checks them with one small query that uses no warehouse. Under More options you can fix a warehouse, a role, a default database and a default schema. If you leave the warehouse empty and your user has no default, PopMCP uses the smallest one your role can see and tells you which.
Connect in PopMCP
Open your workspace, choose Snowflake in the marketplace, and fill in the connect dialog:
| Field | What to enter |
|---|---|
| Account identifiertext | In Snowsight, open the account menu at the bottom left and choose View account details. A Snowflake or Snowsight link works too. |
| Access tokensecret | In Snowsight: Governance & security, Users & roles, your user, Programmatic access tokens, Generate new token. Already use key-pair sign-in? Paste the private key here and add your username below. Stored encrypted.Encrypted with AES-256-GCM on save and never shown again. |
| Warehousetext | The warehouse queries run on. Left empty, your default is used, or else the smallest one your role can see. |
| Roletext | Fixes the connection to this role. Left empty, your default role is used. |
| Default databasetext | Lets the AI leave out the database. It can still reach others your role can. |
| Default schematext | Lets the AI leave out the schema. |
| Username (only for a private key)text | The Snowflake user the private key belongs to. |
| Private key passphrasesecret | Only if your private key is encrypted.Encrypted with AES-256-GCM on save and never shown again. |
PopMCP verifies the credential against Snowflake immediately. On success the connection flips to Verified and its MCP tools are provisioned.
Verify it worked
PopMCP marks the Snowflake connection Verified with your account and user, such as MYORG-MYACCOUNT (ANNA), and records your role, warehouse and region. Asking the AI which databases you can see returns them without using a warehouse.
Troubleshooting
"Snowflake only accepts this token from a user covered by a network policy..."
Why: Your user is not covered by a network policy, and Snowflake requires one for a person's token by default.
Fix: Ask an admin to run the SQL in step 4, or connect with a private key, which does not need one.
"Your Snowflake network policy blocks PopMCP..."
Why: A network policy on the account or user does not allow PopMCP's address. The message shows the address when Snowflake names it.
Fix: Ask an admin to add that address to an allowed network rule, then connect again.
"Snowflake did not accept this token..."
Why: It expired, was revoked, was copied incompletely, or belongs to another account. Tokens last 15 days unless set longer, and are turned off automatically if found in a public GitHub repository.
Fix: Generate a new one under **Programmatic access tokens** with a longer **Expires in**, and connect again.
"PopMCP could not find the Snowflake account..."
Why: The account identifier is wrong, or it is a private link address.
Fix: Copy the **Account identifier** from **View account details** in Snowsight.
"Snowflake refused the role..."
Why: The role under More options is not one your user holds, or the token is restricted to a different role.
Fix: Leave **Role** empty to use the token's role, or make a new token for that role.
Queries say no warehouse is selected
Why: Your role cannot use any warehouse, or none is set.
Fix: Ask an admin to GRANT USAGE on a warehouse to the role, or set one under More options.
"Object does not exist or not authorized"
Why: The name is wrong, or the role has no access to it. Snowflake says the same for both.
Fix: Check the role in the connection, and grant it USAGE on the database and schema and SELECT on the table.