;}%20.st6{fill:url(%23SVGID_00000021089067129159788970000008246765442136188072_);}%20.st7{fill:url(%23SVGID_00000117639240116366130650000015074833605515028638_);}%20.st8{opacity:0.4;fill:url(%23SVGID_00000101781798616409025840000016567063639337360777_);}%20.st9{opacity:0.4;fill:url(%23SVGID_00000052086836598721292040000002033117744178971046_);}%20.st10{opacity:0.4;fill:url(%23SVGID_00000159460939004760751800000002448009281983951536_);}%20.st11{opacity:0.4;fill:url(%23SVGID_00000013177830667419993080000017721442101626521532_);}%20.st12{opacity:0.4;fill:url(%23SVGID_00000152235521444854938490000006526001119318383285_);}%20.st13{opacity:0.4;fill:url(%23SVGID_00000119823135212293698520000012774889010992664993_);}%20%3c/style%3e%3cg%3e%3cpolygon%20class='st2'%20points='134.78,14.22%20114.31,48.21%20101.33,69.75%20158.22,69.75%20177.97,36.95%20191.67,14.22%20'/%3e%3cpolygon%20class='st3'%20points='227.55,69.75%20186.61,69.75%20101.33,69.75%20129.78,119.02%20158.16,119.02%20228.61,119.02%20256,119.02%20'/%3e%3cpolygon%20class='st3'%20points='136.93,132.47%20116.46,167.93%2073.82,241.78%20130.71,241.78%20144.9,217.2%20180.13,156.18%20193.82,132.46%20'/%3e%3cpolygon%20class='st3'%20points='121.7,131.95%20101.23,96.49%2058.59,22.63%2030.15,71.91%2044.34,96.49%2079.57,157.5%2093.26,181.22%20'/%3e%3cpolygon%20class='st2'%20points='64.81,131.95%2025.15,131.21%200,130.74%2028.44,180.01%2066.73,180.72%2093.26,181.21%20'/%3e%3cpolygon%20class='st2'%20points='165.38,181.74%20184.58,216.46%20196.75,238.47%20225.19,189.2%20206.66,155.69%20193.83,132.46%20'/%3e%3c/g%3e%3c/svg%3e)
Windmill HubQuery Snowflake from any Windmill script, flow or app. SQL runs natively — no client library, no boilerplate.
Set up in 3 steps
Set up a key pair
Snowflake authenticates with an RSA key pair rather than a password. Generate one, assign the public key to your user, and keep the private key.
Collect the account details
You need the account identifier, and the warehouse, database, schema and role the queries should run under — all in the Snowflake console.
Add the resource in Windmill
Open Resources, add a resource of type snowflake, and fill the fields.
Scripts
Building blocks, if none of the projects above fit. Fork one, run it, or call it as a step inside your own flow.
Resource types
The credential shapes the scripts on this page expect — pick the one your script asks for.
snowflake
View raw schema →| Field | Type | Required | What it is |
|---|---|---|---|
| account_identifier | string | Yes | <orgname>-<account_name> |
| database | string | No | |
| private_key | string | Yes | -----BEGIN PRIVATE KEY----- .... -----END PRIVATE KEY----- |
| public_key | string | Yes | -----BEGIN PUBLIC KEY----- .... -----END PUBLIC KEY----- |
| role | string | No | |
| schema | string | No | |
| username | string | Yes | |
| warehouse | string | No |
snowflake_oauth
View raw schema →| Field | Type | Required | What it is |
|---|---|---|---|
| account_identifier | string | Yes | <orgname>-<account_name> |
| token | string | Yes | OAuth access token, filled in and refreshed by Windmill's Snowflake OAuth connection |
| database | string | No | Database to use. dbt requires one. |
| warehouse | string | No | Warehouse to use. The user's default warehouse when empty. |
| role | string | No | Role to use. The user's default role when empty. |
| schema | string | No | Schema to use. |
Questions
Why a key pair and not a password?
It is what Snowflake expects for programmatic access, and it sidesteps the MFA prompts that break an unattended run.
Why do I have to name a warehouse and a role?
Snowflake bills compute per warehouse and resolves access per role, so a session has to state both. Naming them here pins what every script costs and sees.
Are my credentials stored on the hub?
Never. They live only in your own Windmill workspace, encrypted at rest.