# Snowflake + Lutril: setup guide

> Lutril needs your account identifier and a programmatic access token to list, create, disable and grant roles to Snowflake users through the REST API. Every statement below runs in a Snowsight worksheet and takes about five minutes end to end. Snowflake scopes roles and users per account, so a token only ever reaches the one account it was made in: run this once per environment you want governed.

Source: https://www.lutril.com/integrations/snowflake
Category: Infrastructure
Auth: api_key
Last verified: 2026-08-11

---

## Setup

1. [object Object]
2. [object Object]
3. [object Object]
4. [object Object]
5. [object Object]
6. [object Object]
7. [object Object]
8. In Lutril, connect Snowflake and paste the account identifier and the token. Set a calendar reminder to rotate before the expiry you chose: when a token lapses, listing and provisioning stop and any access review covering this account goes stale.

## Access requested

- SECURITYADMIN, granted to the service user and set as the token's ROLE_RESTRICTION
- A network policy covering the service user (Snowflake requires one before a service token works)
- REST API v2: GET /users, GET /roles, POST /users, PUT /users/{name}, POST /users/{name}/grants

## References

- [Snowflake documentation](https://docs.snowflake.com/en/user-guide/programmatic-access-tokens)
- [Snowflake console](https://app.snowflake.com)
- [Account identifiers](https://docs.snowflake.com/en/user-guide/admin-account-identifier)
- [CREATE USER reference](https://docs.snowflake.com/en/sql-reference/sql/create-user)
- [Network policies](https://docs.snowflake.com/en/user-guide/network-policies)
- [REST API user reference](https://docs.snowflake.com/en/developer-guide/snowflake-rest-api/reference/user)
- [REST API authentication](https://docs.snowflake.com/en/developer-guide/snowflake-rest-api/authentication)