Set up a warehouse connection

What each warehouse connection asks for, which sign-in methods it supports, and how to read the errors Golden shows when a connection test fails.

7 min readUpdated September 25, 2026

Every warehouse connection starts from the same dialog, but each warehouse asks for different details and supports different ways to sign in. This guide covers the five warehouses available to every workspace: Snowflake, Databricks, Google BigQuery, Amazon Redshift, and Salesforce Reports.

Open the connection dialog

On the Connect screen, open Cloud data sources and pick a warehouse card under Add new connection.
The dialog opens with the title "Connect to <warehouse>". If you already have saved connections of that type, they are listed at the top so you can open one instead of entering the details again.
For Snowflake, Databricks, and Redshift, give the connection a name in Connection Name. If you leave it blank, Golden names it "<warehouse> Connection".
Pick where it lives in Save to Space. You can choose My private space or any space where you are an Admin or Editor.
Fill in the warehouse details described below, then click Save Connection (or the sign-in button, for warehouses that use one).

Note: When you save a connection to a shared space, Golden first shows a confirmation that the connection's credentials will be shared with that space, with a recommendation to use a dedicated, tightly scoped service user. Check the box and click Continue and save to go ahead.

Warehouse	How you sign in	What else you enter
Snowflake	Key Pair (.p8 File), the default and recommended option. Also Programmatic Access Token (PAT), or Username & Password (deprecated by Snowflake).	Account Identifier, Warehouse, Database. Schema and Role are optional.
Databricks	Personal Access Token.	Server Hostname and HTTP Path. Catalog and Schema are optional.
Google BigQuery	Sign in with your Google account (Connect with Google).	Project ID. Dataset is optional.
Amazon Redshift	An AWS access key, plus a Database sign-in of IAM identity, Database user, or Secrets Manager secret.	Endpoint and Database. AWS Region, Schema, and AWS Session Token are under More options.
Salesforce Reports	Your own Salesforce Connected App, then sign in with Salesforce.	Consumer Key and Consumer Secret. Turn on Sandbox Environment for a sandbox org.

How Golden checks a connection when you save

For Snowflake, Databricks, and Redshift, you can click Test Connection at any time to try the details without saving. Save Connection runs the same check before it saves, so a typo shows up right away instead of the first time you open a table.

If the check fails, a "Last connection test failed" message stays on screen with the reason, and often a suggested fix underneath.
The save button changes to Save anyway. Click it to keep the connection as it is, for example when the warehouse is briefly unavailable.
Editing any field clears the failure, so the next save checks your corrected details again.

Tip: When you edit a saved connection, stored passwords, tokens, and key files are never shown. Their fields appear locked. Leave them alone to keep the stored value, or type a new value to replace it, then click Update Connection.

Snowflake

Enter your Account Identifier (for example xy12345.us-east-1), the Warehouse to run queries on, and the Database. The Warehouse is required: without one, Snowflake can't browse or run queries, and Golden tells you "Snowflake warehouse is required but was not configured."

Leave Authentication Method on Key Pair (.p8 File), or pick another method.
For a key pair, enter the Username and choose your Private Key File (.p8). A .pem file also works.
If the key is encrypted, enter its password in Private Key Passphrase. Leave it blank for an unencrypted key.
For a Programmatic Access Token, paste the token into Access Token. Tokens start with a version prefix such as ver:1:.
Optionally set Role. Leave it blank to use the Snowflake user's default role.

Heads up: If you choose Username & Password, Golden warns: "Snowflake is phasing out password sign-in: MFA is now enforced and single-factor password logins are being disabled through 2026. Prefer Key Pair or a Programmatic Access Token so the connection keeps working."

After a successful test or save, Golden shows which role the connection runs as. Golden only sees the objects that role can access, so if tables you expect are missing, set Role to the role you browse with in Snowflake and test again.

Key file errors

"This private key is encrypted." means the key needs its passphrase: enter it in Private Key Passphrase, or upload an unencrypted .p8 instead. "Could not decrypt the private key" means the passphrase you entered is not the right one for that key.

Snowflake network policy and token errors

Some Snowflake failures can only be fixed in Snowflake itself. When a test fails for one of these reasons, Golden shows the explanation and the step to take.

What happened	What to do
"The IP address Golden connects from is not allowed to access Snowflake". A network policy rejects the connection before any credential is checked, so switching authentication method will not help.	"Ask your Snowflake administrator to add Golden's egress IP range to the account's (or the token user's) network-policy allowlist, or set up Private Link."
Snowflake refused the token outright. Programmatic access tokens usually aren't usable on the account yet.	Ask your Snowflake administrator to enable them and to set a network policy on the token's user. Snowflake requires both before a PAT will authenticate.
The token's user has no network policy.	"Snowflake requires a network policy on the token's user (or on the account) before a programmatic access token can be used. Ask your Snowflake administrator to set one, then test again."
The token has expired.	Generate a new one in Snowflake and paste it into Access Token. Tokens have a maximum lifetime, so they need rotating.
Snowflake didn't recognize the token.	Check that the whole token was pasted and that it hasn't been revoked in Snowflake.

Databricks

Enter the Server Hostname (for example adb-1234567890.1.azuredatabricks.net), the HTTP Path of your SQL warehouse (for example /sql/1.0/warehouses/abc123), and a Personal Access Token. Catalog and Schema are optional.

Search by metadata. When you pick tables, the search box ("Search tables, columns, descriptions...") matches column names, descriptions, tags, and owners from Unity Catalog, not just table names. A result that matched on something other than its name says why, for example "column customer_email".
Metric views are listed but can't be imported yet. Their rows are disabled with the note "Metric views aren't supported yet."
Certified and deprecated columns. With Use semantic layer turned on, a column tagged certified in Unity Catalog shows a green shield next to its name, and a column tagged deprecated shows a red shield.

Note: Use semantic layer is a switch in the connection dialog for Snowflake and Databricks, and it is on by default for new connections. For Databricks it reads column descriptions and certification tags from Unity Catalog when you import.

Google BigQuery

Enter your GCP Project ID. Project IDs are 6 to 30 characters of lowercase letters, digits, and dashes.
Optionally enter a Dataset.
Click Connect with Google. Google's sign-in opens to authorize read-only access. Your credentials stay with Google.

If the Google sign-in behind a BigQuery connection expires, charts that use it show "Reconnect Google BigQuery" with a Reconnect button. A shared connection re-authorizes with the Google account of the person who created it, so only they can reconnect it. Everyone else sees a message asking them to have the connection's owner reconnect it.

Tip: Some organizations require Google sign-ins to be renewed on a schedule. In that case the message says your organization's Google security policy requires periodic re-authentication. That is expected, not a broken connection: reconnect and carry on.

Amazon Redshift

Enter the Endpoint of a provisioned cluster or a Redshift Serverless workgroup, the Database, and an AWS Access Key ID and AWS Secret Access Key. You can paste the endpoint exactly as the AWS console shows it, including a :5439/<database> ending. Golden keeps only the host, so enter the database name in Database as well.

Database sign-in	When to use it
IAM identity (default)	The database user comes from your AWS identity, so no username or secret is needed. Grant that IAM principal redshift:GetClusterCredentialsWithIAM for a provisioned cluster, or redshift-serverless:GetCredentials for Serverless, or the connection is refused with a permissions error.
Database user	Sign in as a named Database User. Not offered for a Serverless endpoint.
Secrets Manager secret	Enter the ARN of an AWS Secrets Manager secret that holds the database credentials.

Under More options you can override the AWS Region (it is detected from the endpoint), set a default Schema, or add an AWS Session Token for temporary credentials.

Heads up: Temporary AWS credentials expire, and a saved connection that uses them stops working when they do. Use permanent keys or a Secrets Manager secret for a connection you plan to keep.

Salesforce Reports

Golden connects to Salesforce through a Connected App that you create in your own Salesforce org. The dialog shows the callback URL to register with it.

In Salesforce, go to Setup, then App Manager, and create an app with OAuth enabled. New orgs create an External Client App, which also needs "Enable Authorization Code and Credentials Flow" ticked under its OAuth settings.
Select an API scope (api or full) and refresh_token. The refresh_token scope is what keeps the connection from expiring after a couple of hours.
Set the callback URL shown in the Golden dialog.
Copy the app's Consumer Key and Consumer Secret into the dialog.
Turn on Sandbox Environment if the org is a Salesforce sandbox.
Click Connect with Salesforce Reports and sign in.

Note: Salesforce takes a few minutes to apply OAuth changes, so a sign-in right after you create the app can fail. Wait a few minutes and try again. If Golden warns that your OAuth app didn't return a refresh token, add the refresh_token scope to the app and reconnect.