Skip to main content
Ordyn connects to Snowflake with key-pair authentication. Ordyn generates an RSA key pair per connection, you set the public key on a dedicated read-only service user, and Ordyn signs a short-lived token per request. There is no password or token to rotate.
1

Connect

Go to Connections, click Connect next to Snowflake, and choose a service user name. The default is STRUCT_READER.
2

Run the setup SQL

Copy the generated SQL into a Snowsight worksheet and run it as an admin. It creates the service user, sets the public key, and grants a read-only role.
3

Enter your account identifier

From your Snowsight URL app.snowflake.com/<org>/<account>, join the two segments with a dash, for example mkzwlrt-qx41832. Warehouse, default database, and event table are detected automatically.

​
What Ordyn reads

  • Event tables. Logs, traces, and metrics from stored procedures, UDFs, Snowpark, tasks, and dynamic tables.
  • Query history. Failed loads, pipeline errors, and slow queries from the last 7 days.
  • Read-only SQL against the tables you grant.

​
Permissions

The service user’s role needs SNOWFLAKE.EVENTS_VIEWER, USAGE on one warehouse, and SELECT on the databases Ordyn should read. MONITOR on that warehouse lets Ordyn see queries other users ran on it; the setup SQL grants it too.

​
Read-only queries and telemetry

Read event-table logs, traces and metrics, query history, and the tables you grant.

​
Other users’ query history

Only needed to see queries that other users and roles ran on the warehouse. Without it, INFORMATION_SCHEMA.QUERY_HISTORY returns only the service user’s own queries.
  • The setup SQL Ordyn generates grants SELECT across your current standard databases. If you create a database later, re-run its EXECUTE IMMEDIATE block, or grant it on its own with the commands below.

​
How to grant

Replace the values in angle brackets. Permission catalog version 2026-10-16.1. See permission changes. To revoke access:
Optionally restrict where the service user can connect from with a network policy. Contact support for Ordyn’s egress IP addresses.