Connect Snowflake
What your Snowflake admin sets up, how live queries and credits work, what the semantic layer switch reads, and how to fix the errors you're most likely to hit.
Connect Snowflake and Golden queries it live. Nothing is copied out of your account: every chart runs in your warehouse, as the role you give the connection. This page covers what to set up on the Snowflake side, what happens after you connect, and how to read the errors.
Before you start (for your Snowflake admin)
Create a dedicated service user and role for Golden. A narrow read-only role keeps the connection to the data you mean to share, and it's what everyone in a shared space will query as.
CREATE ROLE GOLDEN_READER;
GRANT USAGE ON WAREHOUSE ANALYTICS_WH TO ROLE GOLDEN_READER;
GRANT USAGE ON DATABASE SALES TO ROLE GOLDEN_READER;
GRANT USAGE ON ALL SCHEMAS IN DATABASE SALES TO ROLE GOLDEN_READER;
GRANT SELECT ON ALL TABLES IN DATABASE SALES TO ROLE GOLDEN_READER;
GRANT SELECT ON ALL VIEWS IN DATABASE SALES TO ROLE GOLDEN_READER;
GRANT SELECT ON FUTURE TABLES IN DATABASE SALES TO ROLE GOLDEN_READER;
CREATE USER GOLDEN_SVC
TYPE = SERVICE
DEFAULT_ROLE = GOLDEN_READER
DEFAULT_WAREHOUSE = ANALYTICS_WH
RSA_PUBLIC_KEY = '<your public key>';
GRANT ROLE GOLDEN_READER TO USER GOLDEN_SVC;- Sign-in: a key pair (.p8 file) is the recommended option. A programmatic access token (PAT) works too. Snowflake is phasing out password sign-in, so avoid it for new connections.
- Warehouse: the role needs USAGE on it. Golden can't browse or query without one.
- Network policy: if your account restricts sign-in by IP, contact Golden support for the address range to allow, or ask about Private Link.
Connect
- In a space, click Create and choose Saved connection, then pick Snowflake.
- Enter the Account Identifier (for example xy12345.us-east-1), Warehouse, and Database. Schema and Role are optional.
- Choose Key Pair (.p8 File) and upload the private key, or paste a PAT.
- Click Save Connection. Golden tests the connection first and shows which role it runs as.
The field-by-field detail for every sign-in method is in Set up a warehouse connection.
Pick your data
After you save, the import wizard opens with the title "Import Schema from <connection>". It has three tabs: Browse Tables, Query Builder, and Custom SQL.
- Browse Tables: search with "Search tables, columns, descriptions...", then tick up to 10 tables. Golden suggests relationships between them so you can chart across them.
- Query Builder: pick a table, columns, and filters, then click Preview Query to see the generated SQL. Copy SQL or Edit in Custom SQL takes it further.
- Custom SQL: write a single read-only SELECT. Validate Query checks it before you import. Anything that writes, or more than one statement, is refused with "Only read-only SELECT queries are allowed here".
- Click Import Schema to finish.
The browser lists every database the role can see, not only the one in the Database field. Snowflake's own SNOWFLAKE and SNOWFLAKE_SAMPLE_DATA databases load last. Semantic views are listed with a "Semantic view" tag and can be imported like any table — see Work with semantic views.
How queries and refresh work
Snowflake connections are live. Import Schema saves the shape of your tables, never the rows. Every chart, filter, and AI question runs a fresh query in Snowflake, so what you see is always current.
- Golden reuses a chart's result for 5 minutes, so flipping between sheets doesn't re-run the same query.
- There's nothing to schedule. Reopen a dashboard and it queries the warehouse again.
- If the warehouse is suspended, Golden resumes it. Opening the browser or loading a dashboard can wake the warehouse and use credits, so set a short auto-suspend on the warehouse you give Golden.
Use semantic layer
Turn on Use semantic layer in the connection dialog and Golden reads the metadata your team already maintains in Snowflake:
- Column comments become field descriptions in the data pane.
- Object tags show up on the fields they're attached to, including Snowflake's automatic classification tags.
- A CERTIFICATION_STATUS tag of CERTIFIED or DEPRECATED marks the field as certified or deprecated.
Tags need Snowflake Enterprise edition and a role allowed to read them. Without that, Golden still reads comments. To pick up changes later, open the dataset and click Refresh from semantic layer.
Limits
| Limit | Value |
|---|---|
| Chart query time | 120 seconds. After that the chart shows a timeout error. |
| Rows in a table chart | 50,000. Totals are still computed over every row. |
| Queries running at once | 4 per dataset. The rest wait their turn. |
| Query rate | 600 per minute per account. Past that: "Too many queries right now. Please wait a moment and try again." |
| Tables per import | 10 |
Troubleshooting
| What you see | What to do |
|---|---|
| Snowflake warehouse "X" wasn't found among the warehouses your role can access. | Check the warehouse name on the connection, and grant the role USAGE on it. |
| Snowflake warehouse "X" could not be activated | The role can see the warehouse but can't use it. Grant USAGE, or pick another warehouse. |
| Snowflake role "X" could not be activated | The user hasn't been granted that role. Grant it, or clear Role to use the user's default. |
| Snowflake account not found. | The Account Identifier is wrong. Copy it from Snowsight's account menu, for example xy12345.us-east-1. |
| This programmatic access token has expired. | PATs have a maximum lifetime. Generate a new one in Snowflake and paste it into the connection. |
| Snowflake didn't recognize this programmatic access token. | Re-paste the whole token (it starts with a prefix like ver:1:) and check it hasn't been revoked. |
| A network policy error | Your account's IP allowlist is refusing Golden. Contact Golden support for the range to allow, or ask about Private Link. |
| Tables you expect are missing | The connection only sees what its role sees. Set Role to the role you browse with in Snowflake, test again, then click Refresh in the browser. |