Sign in to Snowflake or Databricks as yourself

A per-user connection has no shared service account. Each person signs in with their own Snowflake or Databricks identity, so warehouse roles and policies apply per person.

6 min readUpdated November 4, 2026

Most warehouse connections sign in with one shared set of credentials. A per-user connection works differently: each person who uses it signs in to Snowflake or Databricks with their own account. Golden then queries the warehouse as that person, so your warehouse roles, row-access policies and masking apply to each of them, and nobody sees data their own account can't reach.

Start a per-user connection

In a space, click Create and choose Saved connection.
In Connect to your cloud data, pick Snowflake or Databricks.
Under Authentication Method, choose Sign in with Snowflake (per-user) or Sign in with Databricks (per-user). The credential form is replaced by a short setup checklist.

Note: Per-user sign-in isn't offered when you add a connection from inside an analysis, and it applies to new connections only. Set it up from a space so it can be shared with the people who need it.

Set up Snowflake

Enter your Account Identifier (for example myorg-myaccount) and click Continue.
Under Create the integration in Snowflake, click Copy SQL, then Open Snowsight. Run the SQL in a worksheet as a Snowflake admin. It creates the security integration Golden uses, with Golden's public key already embedded. Golden never runs it for you.
Run SYSTEM$SHOW_OAUTH_CLIENT_SECRETS in Snowflake, then paste the OAUTH_CLIENT_ID, or the whole copied result, into OAuth Client ID and click Save.
Under Connect your account, click Authorize and sign in to Snowflake in the window that opens. When it finishes, the step reads Connected as followed by your email.

Tip: Pasting the whole result is safe. Golden keeps only the client ID and drops the client secret in your browser before anything is sent. If the field still contains a secret, Save stays disabled until you paste just the ID or the full result.

What the integration does

It creates a Snowflake security integration for authorization-code OAuth. Each Golden user signs in as themselves, so your Snowflake roles, row-access policies and masking apply per user. The integration trusts Golden through the embedded public key, and no shared secret is stored.

Hand setup to a Snowflake admin

If you aren't a Snowflake admin, click Send to Snowflake admin in the client ID step and copy the secure link it creates. Send your admin the link along with the SQL (use Copy SQL), since the link page doesn't show it. After running the SQL, they open the link, which doesn't need a Golden account. On the page titled Connect Golden to Snowflake, they run SYSTEM$SHOW_OAUTH_CLIENT_SECRETS, paste the client ID or the whole result, and click Submit. The next time you open the checklist, the client ID step shows it was received, and you can go on to Connect your account.

Note: The link works once and expires after 72 hours. If it has been used or has expired, create a new one.

Fix a wrong client ID

A mistyped client ID isn't rejected when you save it. It shows up later, as a failure when you authorize. Once an ID is saved, the step shows that it was received, with a Wrong ID? Change it link beside it. Click it to paste the correct ID, or click Cancel to keep the one you have.

Set up Databricks

Enter your Workspace URL (for example dbc-1234abcd.cloud.databricks.com) and click Continue.
Under Register an OAuth app in Databricks, open your Databricks account console (not a workspace setting) and go to Settings → App connections → Add connection.
Register the Redirect URL shown in Golden (use Copy), select the SQL access scope, and uncheck Generate a secret so the app is a public client.
Copy the generated Client ID into OAuth Client ID and click Save.
Under Connect your account, click Authorize and sign in to Databricks.

Golden signs in to Databricks without storing a secret, and requests offline access so it can refresh your session without asking you to sign in again. Your Unity Catalog grants, row filters and column masks apply per user.

Finish setup later

Setup is saved as you go, so you can stop partway through. The unfinished connection stays in the space. Open it to reopen the checklist in a dialog titled Finish connecting Snowflake (or Databricks), which picks up at the step you reached.

In a shared space, a per-user connection's card shows its state next to its owner's name: Setup incomplete, Active, Setup error or Disabled. Clicking an Active connection opens it for import, the same as a shared connection.

Use a per-user connection

When you open a per-user connection to import data, Golden first checks that you have signed in yourself. If you haven't, the dialog explains that you haven't connected your own identity yet and offers a Connect your Snowflake account (or Databricks) button. After that, pick a Warehouse to browse. You only see the data your own account can access.

Snowflake lists every database your role can see. System databases such as SNOWFLAKE and SNOWFLAKE_SAMPLE_DATA are listed too, but load after your own databases.
Databricks lists every catalog you can see, and each table carries its own catalog.
Moving a per-user connection into a shared space shares no credentials. Each member signs in with their own identity the first time they use it.

Reconnect when your session expires

If your warehouse session expires, charts built on the connection show a Reconnect Snowflake (or Reconnect Databricks) prompt that says your session expired. Click Reconnect to sign in again, and the data reloads. If your account simply can't read the data, the chart says your account doesn't have access to it instead, and reconnecting won't change that. Ask your warehouse admin for access.