Connect your app to Snowflake

1. 1

   Find your Snowflake account URL, which looks like 'https://<orgname>-<account_name>.snowflakecomputing.com'.

   Lovable needs this address to know where to connect to your Snowflake account.

2. 2

   Create a special, limited-access role in Snowflake (e.g., 'LOVABLE_ROLE') and grant it access to a warehouse and only the specific data your app needs.

   This ensures your Lovable app can only see and do what's necessary, improving security and preventing accidental access to sensitive data. Lovable will reject overly powerful roles.

3. 3

   Create a dedicated Snowflake OAuth security integration (e.g., 'LOVABLE_OAUTH') with specific settings, including Lovable's redirect URI and allowing the 'LOVABLE_ROLE'.

   This sets up the secure connection method, allowing Lovable to talk to Snowflake without needing your direct login details every time.

4. 4

   Retrieve the 'oauth_client_id' and 'oauth_client_secret' from the newly created security integration in Snowflake.

   These are like a username and password for the secure connection, which Lovable will use to identify itself to Snowflake.

5. 5

   In Lovable, go to 'Connectors', select 'Snowflake', and click 'Add connection'.

   This starts the process of setting up the connection within your Lovable workspace.

6. 6

   Enter a display name for your connection, the Account URL, Client ID, Client Secret, and the 'LOVABLE_ROLE' you created.

   This provides Lovable with all the necessary information to establish and manage the secure connection to your Snowflake account.

7. 7

   Choose who in your Lovable workspace can use this connection and then click 'Connect'.

   This controls access to your Snowflake data within Lovable and initiates the final authorization step.

8. 8

   Sign in to Snowflake as the dedicated user you set up, review the requested role, and click 'Allow' in the pop-up window.

   This is the final step where you grant Lovable permission to use the 'LOVABLE_ROLE' to access your Snowflake data.

9. 9

   After connecting, link the Snowflake connection to your project and ask Lovable in chat to run a simple query (e.g., 'Use Snowflake and show the ten most recent rows from MY_SCHEMA.MY_TABLE').

   This verifies that the connection works correctly and that the role has the necessary permissions to access data and a warehouse.

Connect my Lovable project to Snowflake. I have my Snowflake account URL, a dedicated role named LOVABLE_ROLE with appropriate grants, and the Client ID and Client Secret from my Snowflake OAuth integration. I've also set up a dedicated user to authorize the connection. Please guide me through the steps in the Lovable UI to finalize this connection and link it to my project.

OAuth

A secure way for one service (like Lovable) to access another service (like Snowflake) on your behalf, without you having to share your actual username and password. It uses temporary 'tokens' instead.

SQL REST API

A way for computer programs to talk to Snowflake and run database commands (SQL) over the internet, like asking for data or telling it to do something.

Warehouses

In Snowflake, a 'warehouse' is like a virtual computer cluster that runs your queries. You need one to process your data.

Connector Gateway

Lovable's secure middleman that handles all communication between your app and external services like Snowflake, managing security tokens and connections.

Least-privilege role

A special user role in Snowflake that has only the bare minimum permissions needed to do its job, and nothing more. This is a security best practice.

Semantic views

Pre-defined, standardized ways of looking at your data in Snowflake that ensure everyone in your organization uses the same calculations and definitions for important metrics, like 'revenue' or 'customer count'.

PKCE

Proof Key for Code Exchange. An extra security step used with OAuth to prevent certain types of attacks, making the connection even safer.

• Using an overly powerful Snowflake role (like ACCOUNTADMIN or SECURITYADMIN) for the connection, which Lovable will reject and is a security risk.
• Not granting the dedicated Snowflake role access to a warehouse or the specific data your app needs, causing queries to fail even if the connection is established.
• Using a 'TYPE = SERVICE' Snowflake user to authorize the connection, as it cannot complete the required interactive login.
• Forgetting to add Lovable's callback URL to your Snowflake OAuth integration's redirect URIs, which prevents the connection from completing.
• Treating the Client ID and Client Secret as less sensitive than passwords; they should be kept private and entered directly into Lovable.
• Not verifying the connection with a real query after setup, which can hide underlying permission issues until later.