Connect a warehouse

Cloud connects your Semantic Rails project to a warehouse using credentials you provide. Every workspace also has access to a read-only hosted sample for trying the workflow.

Choose a connection

These six kinds support customer connections. Enter connection settings separately from the credential; keep passwords, private keys and tokens in the credential fields.

Kind	What you enter	Credential	TLS options
Snowflake (`snowflake`)	Account identifier and user; database, schema and warehouse as needed	Password, key pair or OAuth token. The ADBC connection supports password or key pair only.	—
Postgres (`postgres`)	Host, port, database and user; optional schema	Password	Cloud requires encrypted connections. `sslmode` defaults to `require`; `disable`, `allow` and `prefer` are refused. `require` encrypts the connection without guaranteeing certificate verification. Certificate verification with your own CA is coming.
BigQuery (`bigquery`)	Project; optional dataset and location	Service-account JSON key	—
Databricks (`databricks`)	Host and `http_path`; optional catalog and schema	Token	—
ClickHouse (`clickhouse`)	Host and user; port and database as needed	Password	Cloud requires encrypted connections. `secure` defaults to `true`; `false` is refused. Certificate verification with your own CA is coming.
MotherDuck (`motherduck`)	Database; optional schema	Token	—

For MotherDuck, Cloud checks the catalog and refuses user-defined macros, unsafe views, or a catalog it cannot verify for safe query execution.

Your package's warehouse: must match the bound connection's SQL family. For example, a duckdb package binds to MotherDuck. A mismatch is refused with runtime.warehouse_dialect_mismatch. Cloud reads the bound connection, never the package's default_db; keep connection details in Cloud.

Customers cannot connect Redshift, Athena, DuckDB files or DuckLake. The hosted sample is provided separately.

Network access

The warehouse host must resolve to public addresses only. Private addresses, loopback addresses and single-label hostnames are refused. Private network connections through a tunnel, VPN or PrivateLink are not supported.

If your warehouse uses an IP allowlist, contact support for the current outbound addresses.

Add and test

Open Connections in the Cloud web app and add a connection.
Enter the settings and credential for the selected kind, then save.
Use Test to connect, authenticate and run SELECT 1.

A test has a 30-second limit, with one test at a time per workspace. The result reports ok and latency_ms, or a stable error code such as warehouse.probe_timeout. A timed-out test may still be finishing at the warehouse; wait before starting another.

A successful connection test does not prove that the credential can read your project tables. Validate the project against this warehouse to check that access.

Access and credential changes

Owners, admins and analytics engineers can add credentialed connections. Credentials are encrypted and bound to the host and account they were entered for. Changing the target requires entering the credential again.

To rotate a credential through the REST API, post a replacement payload to /v1/tenants/<workspace id>/credentials/<credential id>/rotate with vault:write and workspace-wide access. Rotation keeps the credential ID, updates connections that reference it and drains adapters holding the old credential. Review the endpoint again in the web app after rotation.

A connection created by an assistant or the API must be reviewed in the web app before the admin MCP can use it. Follow the connection's review link to check its endpoint and enter credentials there.

Next, get a project into Cloud or connect an assistant.