# Snowflake setup for PopMCP You paste two values into PopMCP: your account identifier and a programmatic access token. A token belongs to one account, so there is nothing else to pick. - Auth: API credentials - Setup time: 3 min - API base URL: https://{orgname}-{account_name}.snowflakecomputing.com - Credentials screen: https://app.snowflake.com - Provider docs: https://docs.snowflake.com/en/user-guide/programmatic-access-tokens ## Before you begin - A Snowflake login. Tokens work on every edition, and you do not need an admin to make one for yourself - A role that can do what the AI should do. A token restricted to a read-only role is the safest start - A warehouse that role can use, because SQL runs on a warehouse and uses credits while it runs - If your user is not covered by a network policy, an admin to run one short block of SQL, or a private key instead (see step 4) ## Get your credentials ### 1. Copy your account identifier Sign in to Snowsight at app.snowflake.com. Open the account selector at the bottom of the left menu and choose View account details. Copy the Account identifier, which looks like MYORG-MYACCOUNT. The address of your Snowsight page works too. Screen: https://app.snowflake.com ### 2. Open your user and start a new token In the left menu choose Governance & security, then Users & roles, then select your user. Under Programmatic access tokens choose Generate new token. You need no special privilege to make a token for yourself. Screen: https://app.snowflake.com ### 3. Name the token, set how long it lasts, and pick a role Give it a name such as POPMCP: letters, numbers and underscores only. Set Expires in to more than the 15 day default, up to 365 days, because the connection stops when the token expires. Choose One specific role (recommended) and pick the role the AI should use: it can never go beyond that role. Choose Generate. Screen: https://app.snowflake.com ### 4. Copy the token, and allow it if your user has no network policy Copy the token now: Snowflake shows it once. By default Snowflake only accepts a person's token from a user covered by a network policy. If PopMCP says a network policy is required in the next step, ask an admin to run this in a SQL worksheet, with your username in the last line. It lets your token work without a network policy, and any policy you do have still applies. The Bypass requirement for network policy option in Snowsight's More options menu is temporary, so it is not enough for a lasting connection. USE ROLE ACCOUNTADMIN; CREATE DATABASE IF NOT EXISTS POPMCP_ADMIN; CREATE AUTHENTICATION POLICY IF NOT EXISTS POPMCP_ADMIN.PUBLIC.TOKEN_POLICY PAT_POLICY = (NETWORK_POLICY_EVALUATION = ENFORCED_NOT_REQUIRED); ALTER USER ANNA SET AUTHENTICATION POLICY POPMCP_ADMIN.PUBLIC.TOKEN_POLICY; A user who already has an authentication policy keeps only one, so an admin should add the same setting to that policy instead. Screen: https://docs.snowflake.com/en/user-guide/programmatic-access-tokens ### 5. Paste both into PopMCP In PopMCP, paste the identifier into Account identifier and the token into Access token, then connect. PopMCP checks them with one small query that uses no warehouse. Under More options you can fix a warehouse, a role, a default database and a default schema. If you leave the warehouse empty and your user has no default, PopMCP uses the smallest one your role can see and tells you which. ## Fields PopMCP asks for - Account identifier (account) [required]: In Snowsight, open the account menu at the bottom left and choose View account details. A Snowflake or Snowsight link works too. - Access token (token) [required]: In Snowsight: Governance & security, Users & roles, your user, Programmatic access tokens, Generate new token. Already use key-pair sign-in? Paste the private key here and add your username below. Stored encrypted. - Warehouse (warehouse): The warehouse queries run on. Left empty, your default is used, or else the smallest one your role can see. - Role (role): Fixes the connection to this role. Left empty, your default role is used. - Default database (database): Lets the AI leave out the database. It can still reach others your role can. - Default schema (schema): Lets the AI leave out the schema. - Username (only for a private key) (username): The Snowflake user the private key belongs to. - Private key passphrase (privateKeyPassphrase): Only if your private key is encrypted. ## Verify PopMCP marks the Snowflake connection Verified with your account and user, such as MYORG-MYACCOUNT (ANNA), and records your role, warehouse and region. Asking the AI which databases you can see returns them without using a warehouse. ## Troubleshooting ### "Snowflake only accepts this token from a user covered by a network policy..." Cause: Your user is not covered by a network policy, and Snowflake requires one for a person's token by default. Fix: Ask an admin to run the SQL in step 4, or connect with a private key, which does not need one. ### "Your Snowflake network policy blocks PopMCP..." Cause: A network policy on the account or user does not allow PopMCP's address. The message shows the address when Snowflake names it. Fix: Ask an admin to add that address to an allowed network rule, then connect again. ### "Snowflake did not accept this token..." Cause: It expired, was revoked, was copied incompletely, or belongs to another account. Tokens last 15 days unless set longer, and are turned off automatically if found in a public GitHub repository. Fix: Generate a new one under **Programmatic access tokens** with a longer **Expires in**, and connect again. ### "PopMCP could not find the Snowflake account..." Cause: The account identifier is wrong, or it is a private link address. Fix: Copy the **Account identifier** from **View account details** in Snowsight. ### "Snowflake refused the role..." Cause: The role under More options is not one your user holds, or the token is restricted to a different role. Fix: Leave **Role** empty to use the token's role, or make a new token for that role. ### Queries say no warehouse is selected Cause: Your role cannot use any warehouse, or none is set. Fix: Ask an admin to GRANT USAGE on a warehouse to the role, or set one under More options. ### "Object does not exist or not authorized" Cause: The name is wrong, or the role has no access to it. Snowflake says the same for both. Fix: Check the role in the connection, and grant it USAGE on the database and schema and SELECT on the table. --- Source: https://www.docs.popmcp.com/docs/integrations/snowflake/