Skip to main content
A Snowflake fabric uses a Snowflake virtual warehouse as the compute engine for your pipelines. Prophecy runs pipeline SQL in the warehouse and reads and writes tables in the database and schema you configure. To use Snowflake only as a data source or target, create a Snowflake connection instead.
Available for Express and Enterprise Editions only.

​
Prerequisites

Before you create a Snowflake fabric, make sure you have:
  • A Snowflake account URL.
  • A Snowflake warehouse to execute queries.
  • A role with permissions to use the warehouse, access the database and schema, and read and write to the stage Prophecy uses for temporary files.
  • Credentials for your authentication method: for key-pair authentication, a key pair whose public key is assigned to your Snowflake user; for OAuth, an app registration configured by your cluster admin; for OIDC, service principal credentials issued by your identity provider and a Snowflake External OAuth security integration.

​
Create a Snowflake fabric

You can’t change the fabric provider after you create the fabric.
1

Create a new fabric entity

  1. From the left sidebar, click the + sign.
  2. On the Create Entity page, select Fabric.
2

Fill in the Basic Info tab

The Basic Info tab defines the key identifiers of the fabric.
  1. Provide a name for the fabric.
  2. (Optional) Provide a description for the fabric.
  3. Select a team that can access the fabric.
  4. Click Continue.
3

Fill in the Providers tab

The Providers tab configures the SQL warehouse provider for the fabric.
  1. Under Provider, select Snowflake.
  2. Enter your Account URL. Example: https://uuywwsi-xxxxxxxx.snowflakecomputing.com
  3. Enter the Role that Prophecy uses to access Snowflake resources. Example: TRANSFORM_ROLE
  4. Enter the Warehouse that executes the SQL queries your pipelines generate. Example: ANALYTICS_WH
  5. Enter the default Database where Prophecy reads and writes data. Example: ANALYTICS
  6. Enter the default Schema where Prophecy reads and writes data. Example: PIPELINES
  7. Enter the Prophecy Dataplane URL, which Prophecy uses to orchestrate pipeline execution and data movement.
  8. Select an authentication method and enter its credentials. For the fields each method requires, see Authentication methods.
  9. Provide the Stage where Prophecy stores temporary files during pipeline orchestration. The configured role must have read and write permissions on the stage. Example: @PROPHECY_STAGE
4

Save the fabric

Click Complete to save the fabric.
After you save the fabric, you can add secrets and connections to it.

​
Authentication methods

Snowflake fabrics support the following authentication methods.

​
Key-pair

Key-pair authentication uses an RSA key pair instead of a password.
  1. Enter the Username.
  2. Upload your Private Key file.
The private key must be an unencrypted PKCS#8 key. If your key is encrypted or in PKCS#1 (RSA) format, convert it with OpenSSL:
Key-pair authentication doesn’t support passphrase-protected private keys. Use an unencrypted private key or a different authentication method.

​
OAuth

Use OAuth when an identity provider or service principal manages authentication. Select an App Registration from the dropdown. The dropdown lists the OAuth app registrations your cluster admin has configured for Snowflake, including native Snowflake registrations and any ID Anywhere (Snowflake) registrations. ID Anywhere registrations authenticate through an ADFS or ID Anywhere identity provider instead of Snowflake’s native OAuth. If the registration you need isn’t listed, ask your cluster admin to add it under Settings > Admin > Security. To learn how to create app registrations, see OAuth app registrations. If sign-in through an ID Anywhere (Snowflake) registration fails with a claim mismatch error, the claim that carries the Snowflake username in the ADFS access token doesn’t match Snowflake’s EXTERNAL_OAUTH_TOKEN_USER_MAPPING_CLAIM. Ask your cluster admin to check the ID Anywhere (Snowflake) setup.

​
OIDC

Use OIDC to authenticate as a service principal whose credentials are issued by your identity provider, without an app registration or an interactive sign-in. Prophecy exchanges the credentials for a bearer token through an OIDC federator. Snowflake maps a claim in the token to a Snowflake user through an External OAuth security integration, so OIDC doesn’t take a username.
  1. Enter the Auth Server URL of the token issuer.
  2. Enter the Resource that the token is requested for.
  3. Enter the Service Principal Client ID.
  4. Optionally, select a Service Principal Client Secret.
  5. Select the Certificate and Private Key issued by your identity provider.
For details, see OIDC authentication.

​
Migrate from password authentication

Snowflake is deprecating password-based sign-in for service users as of October 2026. New fabrics don’t offer Username and Password. This option appears only on existing fabrics that already use it, and those fabrics stop connecting once Snowflake enforces the cutover.
Prophecy shows a banner and a Migrate action on fabrics that still use Username and Password authentication. To move an affected fabric to Key-pair or OAuth authentication, click Migrate on the fabric.

​
Edit an existing fabric

To edit an existing fabric:
  1. From the left sidebar, click the Metadata page.
  2. Navigate to the Fabrics tab.
  3. Open the fabric you want to edit.
  4. Update the fabric. Prophecy automatically saves your changes.

​
Edit advanced settings

To edit advanced settings, click the Advanced tab for the fabric. Here, you can select or deselect Allow agent to access data. This allows Prophecy agents to suggest data transformations and actions based on the data in the fabric.

​
Limitations

Snowflake fabrics don’t support:
  • Case-sensitive identifiers.
  • Creating new partitioned tables.
  • Modifying partitioning of existing tables.