Connecting Snowflake

Link a Snowflake account to Neuralift with a read-only service user, and receive segment-labeled results back as a Delta Share your account queries directly.

Neuralift connects to Snowflake with a database user you provide, reading through a virtual warehouse you nominate. This page walks through creating a dedicated read-only service user, adding the connection, and — when runs are published — registering the share that brings results back into Snowflake as queryable tables (Receiving results in Snowflake).

How this connection works

Neuralift connects as a regular Snowflake client, addressed by your account identifier and authenticated as the database user you supply. Read queries run on the virtual warehouse you nominate, so the compute cost and the blast radius are both under your control: grant the user access to only the schemas Neuralift needs, size the warehouse as you see fit, and revoke the user on your side at any time to sever the connection.

Before you begin

You need the admin role in your Neuralift organization; see Roles & permissions.
In Snowflake you need a role that can create users, roles, and grants — typically USERADMIN and SECURITYADMIN, or ACCOUNTADMIN.
Decide which database (or schemas) Neuralift should read, and which warehouse its queries should run on.
Neuralift does not accept any data with PII. Check Data requirements before connecting tables.

Create a read-only service user

Create a dedicated service user and role for Neuralift rather than reusing a person’s account. Adjust the database, warehouse, and password placeholders to your environment:

CREATE ROLE IF NOT EXISTS neuralift_reader;

CREATE USER neuralift_svc
  TYPE = LEGACY_SERVICE            -- a non-human user: password auth, exempt from human MFA enforcement
  PASSWORD = '<strong-generated-password>'
  DEFAULT_ROLE = neuralift_reader  -- required: Neuralift connects without naming a role
  DEFAULT_WAREHOUSE = compute_wh
  MUST_CHANGE_PASSWORD = FALSE;

GRANT ROLE neuralift_reader TO USER neuralift_svc;

GRANT USAGE ON WAREHOUSE compute_wh TO ROLE neuralift_reader;
GRANT USAGE ON DATABASE my_database TO ROLE neuralift_reader;
GRANT USAGE ON ALL SCHEMAS IN DATABASE my_database TO ROLE neuralift_reader;
GRANT SELECT ON ALL TABLES IN DATABASE my_database TO ROLE neuralift_reader;
GRANT SELECT ON ALL VIEWS  IN DATABASE my_database TO ROLE neuralift_reader;

-- keep tables created later readable without re-granting
GRANT USAGE ON FUTURE SCHEMAS IN DATABASE my_database TO ROLE neuralift_reader;
GRANT SELECT ON FUTURE TABLES IN DATABASE my_database TO ROLE neuralift_reader;
GRANT SELECT ON FUTURE VIEWS  IN DATABASE my_database TO ROLE neuralift_reader;

A few notes:

Scope down as far as you like. Grant per-schema or per-table instead of database-wide; Neuralift only ever sees what neuralift_reader can read.
DEFAULT_ROLE is load-bearing. Neuralift’s connection doesn’t name a role, so the user’s default role is the one its queries run with.
Network policies. If your account restricts access by IP, allow Neuralift’s compute egress IPs; your Neuralift contact can provide the current list.
Compute. Neuralift’s reads run on the warehouse you name, under your control and on your account’s billing, like any other client.

Add the connection

In Neuralift, go to Settings → Data Connections and click Add connection.
Under Warehouse type, select Snowflake.
Enter a Connection name (lowercase letters, digits, and dashes; unique within your organization).
Enter your Account identifier, for example <orgname>-<accountname>. Use the organization-and-account form, not a full URL.
Enter the Warehouse name, for example <compute-warehouse>.
Optionally, enter the Database that contains your source tables.
Enter the Username and Password of the service user you created above.
Click Save & connect.

The dialog closes and a Setting up … connection… notice appears. After a moment the new connection card appears with an Active badge (or Error with an explanation) and gains Browse tables and Test buttons.

To rotate the credential later, change the password in Snowflake, then re-save the connection in Neuralift with the new password — it rotates in place, with no need to remove and re-add the connection.

Receiving results in Snowflake

Results come back over Delta Sharing’s open protocol: Neuralift provisions a share for your organization and hands you a one-time activation URL; you register it in Snowflake as a catalog integration with a linked database, and each published run shows up as a queryable table. Configuring delivery is a once-per-organization admin task; the delivery workflow around it is covered in Delivering results to your warehouse.

Configure delivery under Settings → Data Connections → Share your results, choosing Delta Share with the Snowflake (open protocol) recipient type. A Delta Share activation URL appears once — copy it and store it securely.
Open the activation URL and download the credentials file. It contains three values you’ll use below: endpoint, bearerToken, and expirationTime.
As ACCOUNTADMIN (or a role with the CREATE INTEGRATION and CREATE DATABASE privileges), register the share and link it as a database:

CREATE OR REPLACE CATALOG INTEGRATION neuralift_delta_sharing_int
  CATALOG_SOURCE = DELTA_SHARING
  TABLE_FORMAT = DELTA
  REST_CONFIG = (
    CATALOG_URI = '<endpoint from the credentials file>'
    CATALOG_NAME = 'shares/<share-name>'   -- your share's name from the delivery panel, with the literal shares/ prefix
    ACCESS_DELEGATION_MODE = VENDED_CREDENTIALS
  )
  REST_AUTHENTICATION = (TYPE = BEARER BEARER_TOKEN = '<bearerToken from the credentials file>')
  ENABLED = TRUE;

SELECT SYSTEM$VERIFY_CATALOG_INTEGRATION('neuralift_delta_sharing_int');

CREATE OR REPLACE DATABASE neuralift_results
  LINKED_CATALOG = (
    CATALOG = neuralift_delta_sharing_int
    ALLOWED_WRITE_OPERATIONS = 'NONE'
    SYNC_INTERVAL_SECONDS = 30
  );

Each published run your Neuralift team delivers is a table in the linked database:

SELECT * FROM neuralift_results.outputs.sld_<run_id>;

Things to know:

The activation URL works exactly once and can’t be retrieved later. If it’s lost before you’ve downloaded the credentials file, remove the delivery configuration in Neuralift and configure it again to generate a new one.
The bearer token is valid for up to one year, and its expiry is not alerted — put the expirationTime from the credentials file on your calendar. To rotate, generate a new activation URL (re-provision delivery in Neuralift) and re-run the CREATE OR REPLACE CATALOG INTEGRATION statement. The linked database keeps working untouched: it references the integration by name.
New runs appear automatically. The linked database syncs the catalog on the interval you set; no per-run action is needed on your side.
Analyst access is ordinary Snowflake grants on neuralift_results — govern it like any other database.

Troubleshooting

The connection lands on Error. The card shows an explanation. Common causes: the Account identifier isn’t in the <orgname>-<accountname> form, the Warehouse name is misspelled, or the username and password were rejected.
The connection is Active but expected tables are missing. The Snowflake user can only expose what it can read. Confirm neuralift_reader has access to the schemas and tables you need, then use Sync tables in the Source tables sheet to re-discover them.
Test fails on a previously Active connection. The password may have been rotated or the user’s access revoked in Snowflake. Restore access on the Snowflake side, or re-save the connection in Neuralift with the current password.

Note. Credentials are used to provision the connection and are handled as described in Data handling & security.

Next steps

Sync source tables from your new connection.
Review data requirements so your tables are ready for segmentation.
When runs are published, see Delivering results to your warehouse for the delivery workflow.