Linking Snowflake as a source

The data warehouse can link to data in Snowflake.

Start by going to the Data pipeline page and the sources tab and clicking New source. Choose Snowflake and enter the following data:

• Account identifier: Likely a combination of your organization and the name of the account (e.g. myorg-account123). You can find this in the sidebar account selector or by executing the CURRENT_ACCOUNT_NAME and CURRENT_ORGANIZATION_NAME functions in SQL.
• Database: Like tasty_bytes_sample_data
• Warehouse: Like compute_wh
• User: Your username like IANVPH
• Password: The password for your user
• Role (optional): The role with necessary privileges to access your context like accountadmin.
• Schema: The schema for your database like RAW_POS. If it isn't working, trying using all caps.
• Table Prefix: The optional prefix for your tables in PostHog. For example, if your table name ended up being menu, a prefix of snow_prod_ would create a table in PostHog called snow_prod_menu.

Once added, click Next, select the tables you want to sync, as well as the sync method, and then press Import.

Once done, you can now query your new table using the table name.

Direct Snowflake connections

Instead of syncing data on a schedule, you can query your Snowflake database directly from the SQL editor. Direct connections run queries against your live Snowflake instance in real time — no data is copied into PostHog.

To set up a direct connection:

1. Open the SQL editor.
2. Click the connection picker in the toolbar and select Add direct connection > Snowflake.
3. Enter your Snowflake credentials (account identifier, database, warehouse, user, password, and optionally a role and schema) — the same credentials used for scheduled syncs.
4. Select the tables you want to make available, then click Link.

Once connected, switch to your Snowflake connection in the SQL editor's connection picker and write queries against your live data.

When to use direct connections vs scheduled syncs

• Direct connections are best for ad-hoc exploration, querying data that changes frequently, or when you don't want to duplicate data into PostHog.
• Scheduled syncs are better when you need faster query performance, want to join external data with PostHog events in dashboards and insights, or need data available across all PostHog features.

Limitations

Direct Snowflake queries are read-only. Some HogQL constructs are not supported and return a clear error if used:

• SAMPLE
• PREWHERE
• ARRAY JOIN
• LIMIT BY
• Tuple expressions
• Array slices

Troubleshooting

Network policy blocking connection

Problem: Your Snowflake sync fails with an error like:

Incoming request with IP/Token is not allowed to access Snowflake. Contact your account administrator.

Solution: Your Snowflake account has a network policy (IP allowlist) that doesn't include PostHog's egress IP addresses. Ask your Snowflake administrator to add the IP addresses listed in the Configuration section below to your network policy allowlist. Once updated, retry the sync.

Invalid JWT token with key-pair authentication

Problem: Your Snowflake sync fails with an error like:

JWT token is invalid

Solution: Snowflake rejected key-pair authentication because the private key you configured doesn't match the public key registered on the Snowflake user. This can happen when:

• The public key was rotated or removed from the Snowflake user
• You pasted the wrong private key
• The private key belongs to a different Snowflake user

To fix this, verify that the public key matching your private key is registered on your Snowflake user. See Snowflake's key-pair authentication documentation for instructions. Either re-register the matching public key on the Snowflake user, or update your PostHog source configuration with the correct private key. Once corrected, resync your data.

Multi-factor authentication enrollment required

Problem: Your Snowflake sync fails with an error like:

Multi-factor authentication is required for this account. Log in to Snowsight to enroll.

Solution: The Snowflake account requires MFA enrollment, but the connecting user hasn't enrolled. PostHog runs unattended syncs that can't complete an MFA enrollment flow, so retrying never succeeds.

To fix this, connect with a service user that uses key-pair authentication (which bypasses MFA), or use a user account that is exempt from your account's MFA requirement. Once updated, resync your data.

Configuration

Inbound IP addresses

We use a set of IP addresses to access your instance. To ensure this connector works, add these IPs to your inbound security rules: