Connecting Perplexity with Snowflake - Perplexity Help Center

This guide walks Snowflake and Perplexity administrators through connecting a Snowflake data warehouse to Perplexity, and shows Pro, Max, Enterprise Pro, and Enterprise Max subscribers how to sign in.

Overview

The Snowflake connector lets you query data in your Snowflake data warehouse directly from Perplexity. You can search and combine information across your Snowflake databases, your other connected apps, and the web without writing SQL by hand or switching to the Snowflake console. Connecting Snowflake is done per user. No one else in your organization can query your data unless you sync it to a shared Project.

The Snowflake connector is available on the Pro, Max, Enterprise Pro, and Enterprise Max plans. Generating a Data Map requires Enterprise Pro or Enterprise Max. On every plan, a Snowflake administrator with the ACCOUNTADMIN role creates the security integration or service account; on Enterprise plans, a Perplexity administrator configures the User OAuth connector once for the organization.

Privacy and data security

The connector queries your Snowflake account under a Snowflake role you control, so Snowflake privileges are the boundary on what Perplexity can reach. Grant that role read access only.

Access scope — Each person connects their own account. No one else in your organization can query your data unless you sync it to a shared Project.
Where data is stored — Perplexity does not store your Snowflake data. Queries run against your own Snowflake account, and the connector adds no storage of its own beyond the operational data Perplexity collects to run the product.
Retention — The connector does not operate a cache, so there is no separate copy of your Snowflake data to retain or delete.
Administrator control — On Enterprise plans, your organization administrator can disable the Snowflake connector for your organization, in which case it does not appear in your connector settings.
Read-only enforcement — Enforce read-only access through Snowflake privileges. Do not grant the role Perplexity uses any write or object-creation privilege.
Training use — Data accessed through the Snowflake connector is never used to train Perplexity’s models or any third-party model.
Sub-processors — Authentication and API traffic for this connector routes through Merge Agent Handler, operated by Merge API, Inc., a Perplexity sub-processor. The current list is published in the Perplexity Trust Center.
Encryption — Connector credentials and connected data are encrypted in transit with TLS and at rest with AES-256.
Compliance — Perplexity’s controls are audited under SOC 2 Type II. Security and compliance documentation is available in the Perplexity Trust Center.

How to activate it

Choosing an authentication method

Perplexity offers two Snowflake connectors. Configure only the one that matches how your users authenticate.

Connector	Queries run as	Credential	Audit trail	Use it when
Snowflake (User OAuth)	Each user’s own Snowflake account	OAuth	Attributed per user in Snowflake’s audit logs	Recommended for most organizations
Snowflake (Service Account)	One shared service account	Key pair	Shared identity	Users query through a single account

Table 1 — The two Snowflake connectors and when to use each.

Perplexity strongly recommends the User OAuth connector. Queries use each person’s own Snowflake permissions and are attributed to them in Snowflake’s audit logs.

Before you start

You are on the Pro, Max, Enterprise Pro, or Enterprise Max plan.
On Enterprise plans, your organization administrator has not disabled the Snowflake connector.
Your Snowflake administrator has ACCOUNTADMIN access, or equivalent privileges.
OpenSSL is installed locally, for service account setup only.

Set up the User OAuth connector

Ask your Snowflake administrator to create the security integration. See the Snowflake OAuth security integration documentation for additional parameters.

USE ROLE ACCOUNTADMIN;
CREATE SECURITY INTEGRATION PERPLEXITY_OAUTH
  TYPE = OAUTH
  ENABLED = TRUE
  OAUTH_CLIENT = CUSTOM
  OAUTH_CLIENT_TYPE = 'CONFIDENTIAL'
  OAUTH_REDIRECT_URI = 'https://ah.merge.dev/oauth/callback'
  OAUTH_ISSUE_REFRESH_TOKENS = TRUE
  OAUTH_REFRESH_TOKEN_VALIDITY = 7776000
  OAUTH_USE_SECONDARY_ROLES = IMPLICIT
  COMMENT = 'OAuth security integration for Perplexity';

Retrieve the client ID and client secret.

SELECT SYSTEM$SHOW_OAUTH_CLIENT_SECRETS('PERPLEXITY_OAUTH');

Enter those credentials in the OAuth setup modal in Perplexity.

Use OAUTH_USE_SECONDARY_ROLES = IMPLICIT so users can reach their secondary roles in addition to their default roles. Use NONE if users should be restricted to just their DEFAULT_ROLE in Snowflake.

Set up the service account connector

A service account is a dedicated Snowflake user that runs under one specific role. Everyone using the shared account has the same access, so grant that role only the data access Perplexity needs.

Generate a private key and its matching public key in your local terminal.

openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out snowflake_computer_key.p8 -nocrypt
openssl rsa -in snowflake_computer_key.p8 -pubout -out snowflake_computer_key.pub

Create a dedicated role and a warehouse, choosing the warehouse size that matches your query volume. You can also use an existing warehouse instead of creating one.

USE ROLE ACCOUNTADMIN;
CREATE ROLE IF NOT EXISTS PERPLEXITY_ROLE
  COMMENT = 'Role for Perplexity service account';
CREATE WAREHOUSE IF NOT EXISTS PERPLEXITY_WAREHOUSE
  WAREHOUSE_SIZE = 'SMALL'
  AUTO_SUSPEND = 60
  AUTO_RESUME = TRUE
  COMMENT = 'Warehouse for Perplexity queries';
GRANT USAGE ON WAREHOUSE PERPLEXITY_WAREHOUSE
  TO ROLE PERPLEXITY_ROLE;

Create the service account user. Replace the RSA_PUBLIC_KEY value with the contents of snowflake_computer_key.pub, excluding the BEGIN PUBLIC KEY and END PUBLIC KEY lines.

CREATE USER PERPLEXITY_USER
  TYPE = SERVICE
  DEFAULT_ROLE = PERPLEXITY_ROLE
  DEFAULT_WAREHOUSE = PERPLEXITY_WAREHOUSE
  COMMENT = 'Service account for Perplexity'
  RSA_PUBLIC_KEY = 'MIIBIjANBgkqhki...your_public_key_here...IDAQAB';
GRANT ROLE PERPLEXITY_ROLE TO USER PERPLEXITY_USER;

Grant access to the data you want Perplexity to query. Replace MY_DATABASE with your own database. These grants provide read access to its existing and future schemas, tables, and views. For narrower access, grant permissions on specific schemas or objects instead. See the Snowflake GRANT documentation.

GRANT USAGE ON DATABASE MY_DATABASE TO ROLE PERPLEXITY_ROLE;
GRANT USAGE ON ALL SCHEMAS IN DATABASE MY_DATABASE
  TO ROLE PERPLEXITY_ROLE;
GRANT USAGE ON FUTURE SCHEMAS IN DATABASE MY_DATABASE
  TO ROLE PERPLEXITY_ROLE;
GRANT SELECT ON ALL TABLES IN DATABASE MY_DATABASE
  TO ROLE PERPLEXITY_ROLE;
GRANT SELECT ON FUTURE TABLES IN DATABASE MY_DATABASE
  TO ROLE PERPLEXITY_ROLE;
GRANT SELECT ON ALL VIEWS IN DATABASE MY_DATABASE
  TO ROLE PERPLEXITY_ROLE;
GRANT SELECT ON FUTURE VIEWS IN DATABASE MY_DATABASE
  TO ROLE PERPLEXITY_ROLE;

If you choose to generate a Data Map in the connector setup flow, grant access to the two account usage views it reads. Data Map generation requires Enterprise Pro or Enterprise Max. This grant provides broader access to Snowflake account metadata, not just these two views, so review it before you run it.

View	Availability
SNOWFLAKE.ACCOUNT_USAGE.QUERY_HISTORY	All editions
SNOWFLAKE.ACCOUNT_USAGE.ACCESS_HISTORY	Snowflake Enterprise Edition or higher. On Standard Edition, Perplexity uses QUERY_HISTORY instead

Table 2 — The account usage views a Data Map reads.

USE ROLE ACCOUNTADMIN;
GRANT IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE
  TO ROLE PERPLEXITY_ROLE;

Go to Settings → Connectors in Perplexity and select Snowflake (Service Account).
Select Enable → Add Connector.
Enter your Snowflake account identifier, the username PERPLEXITY_USER, and the private key snowflake_computer_key.p8.
Select Allow to complete setup.

Keep snowflake_computer_key.p8 private. You enter it in Perplexity when connecting, and anyone else holding it can query your warehouse as PERPLEXITY_USER. Enforce read-only access through Snowflake permissions: do not grant PERPLEXITY_ROLE write or object-creation privileges.

Connect your Snowflake account

Once administrator setup is complete, each user connects their own account.

Go to Settings → Connectors → Snowflake (User OAuth) in Perplexity.
Select Enable → Add Connector.
Sign in to Snowflake when prompted.
Select Allow to complete the connection.

How to verify it worked

Open a new session, mention @Snowflake, and ask for something small from a table you can already read in Snowflake, such as a row count. If the answer comes back without your Snowflake data, your Snowflake role is the first thing to check: it needs SELECT on the object you named.

Trying it out

Once Snowflake is connected, mention it in a new session:

@Snowflake How many rows are in the orders table?
@Snowflake Which columns are in the customers table?
@Snowflake List the schemas I can query in MY_DATABASE

Permissions and scopes

The connector needs only read privileges. Grant them to a dedicated role rather than to an existing analyst role.

Privilege	Granted on	Why the connector needs it
USAGE	Warehouse	Run the queries that answer a question
USAGE	Database and schemas	Reach the objects it is allowed to query
SELECT	Tables and views	Read rows. No write privilege is requested
IMPORTED PRIVILEGES	SNOWFLAKE database	Read the two account usage views a Data Map needs. Optional
Refresh token	Security integration	Keep a user connected without re-authenticating, for the validity period you set

Table 3 — Snowflake privileges the connector requests, and why. Snowflake privileges are the enforcement boundary. Whatever the connector is asked to do, it runs under the role you granted, so a role without write privileges cannot write.

Troubleshooting

Symptom you see	Most likely cause	How to fix it
Snowflake is not enabled for your organization, or does not appear in your connector list	On Enterprise plans, an organization administrator disabled it. Otherwise your plan may not include it	On Enterprise plans, contact your organization administrator. Otherwise confirm your plan in Settings
Sign-in or queries fail, and your Snowflake account restricts inbound connections by IP	The Merge tenant addresses are not allowlisted in your Snowflake network policy	Ask your Snowflake administrator to allowlist the US tenant addresses on the Merge tenant IP addresses page
A user reaches less data than they have been granted in Snowflake	The OAuth session activated only their DEFAULT_ROLE	Confirm the security integration sets OAUTH_USE_SECONDARY_ROLES = IMPLICIT
ACCESS_HISTORY is unavailable when generating a Data Map	Your Snowflake account is on Standard Edition	ACCESS_HISTORY needs Enterprise Edition or higher. On Standard Edition, Perplexity uses QUERY_HISTORY instead

Table 4 — Symptom, cause, and fix for the most common Snowflake connector issues. For a service account, this example creates a user-level network policy using the currently published US addresses. Check the Merge tenant IP addresses page for the current list before applying a policy.

USE ROLE ACCOUNTADMIN;
CREATE NETWORK POLICY PERPLEXITY_COMPUTER_POLICY
  ALLOWED_IP_LIST = ('3.216.101.38', '52.20.242.81');
ALTER USER PERPLEXITY_USER
  SET NETWORK_POLICY = PERPLEXITY_COMPUTER_POLICY;

Frequently asked questions

What data does this connector access?

The databases, schemas, tables, and views the Snowflake role you granted is allowed to read. It cannot reach anything that role cannot reach.

Will my Snowflake data be used to train AI models?

No. Data accessed through the Snowflake connector is never used to train Perplexity’s models or any third-party model.

Can my administrator restrict who enables this connector?

Yes, on Enterprise plans. An organization administrator can disable the Snowflake connector for the whole organization, in which case it does not appear in your connector settings.

Can Perplexity write to my Snowflake data?

No, provided you enforce it in Snowflake. Grant the role Perplexity uses only USAGE and SELECT, and Snowflake rejects any write regardless of what Perplexity is asked to do.

Is this connector available on my plan?

Yes, on the Pro, Max, Enterprise Pro, and Enterprise Max plans. Generating a Data Map requires Enterprise Pro or Enterprise Max.

Need more help?

When you write in, include the connector name, the exact error message, the time it occurred, and the steps from this article that did not resolve it.

Reach out to your account team or contact us via Help > Contact Support. Visit the Trust Center for security and compliance documentation.

​Overview

​Privacy and data security

​How to activate it

​Choosing an authentication method

​Before you start

​Set up the User OAuth connector

​Set up the service account connector

​Connect your Snowflake account

​How to verify it worked

​Trying it out

​Permissions and scopes

​Troubleshooting

​Frequently asked questions

​What data does this connector access?

​Will my Snowflake data be used to train AI models?

​Can my administrator restrict who enables this connector?

​Can Perplexity write to my Snowflake data?

​Is this connector available on my plan?

​Related articles

​Need more help?

Overview

Privacy and data security

How to activate it

Choosing an authentication method

Before you start

Set up the User OAuth connector

Set up the service account connector

Connect your Snowflake account

How to verify it worked

Trying it out

Permissions and scopes

Troubleshooting

Frequently asked questions

What data does this connector access?

Will my Snowflake data be used to train AI models?

Can my administrator restrict who enables this connector?

Can Perplexity write to my Snowflake data?

Is this connector available on my plan?

Related articles

Need more help?