Skip to main content
Endgame reads your Salesforce data from the copy that already lives in your Snowflake account. You give Endgame a read-only service account that can see only that copy. You create three things in Snowflake:
  1. A read-only role scoped to the schema that holds your Salesforce mirror.
  2. A service account that uses key-pair authentication, with that role.
  3. An RSA key pair. You register the public key on the service account and keep the private key.
Then you enter the connection parameters and the private key into the credential form on the Endgame welcome screen. The form validates them against Snowflake and stores them securely. You never enter a password, because the account has none.
Creating the role and service account requires a Snowflake role that can grant access (for example SECURITYADMIN), and OpenSSL on your local machine for the key pair.
1

Find the mirror location

Identify the Snowflake database and schema that hold your mirrored Salesforce tables. You need three names: the database, the schema, and a warehouse the read-only account may use. The rest of this page calls them <database>, <schema>, and <warehouse>.
2

Create the read-only role

Run this as a role that can grant access (for example SECURITYADMIN). It creates a role that can read the mirror schema and nothing else.
The FUTURE grants let the role read tables and views added to the mirror schema later, so you do not repeat this when your mirror grows. The role can read only this one schema. It cannot read any other schema, write anything, or change anything.
3

Create the service account

4

Create the key pair

Run these on your own machine. They are the commands from Snowflake’s key-pair authentication documentation for an unencrypted key, which is the format the credential form expects. There is no passphrase.
Register the public key on the service account. Paste the contents of endgame_rsa_key.pub with the -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY----- lines removed and the line breaks removed.
5

Enter the credentials on the welcome screen

Enter these connection parameters into the credential form on the Endgame welcome screen:In the same form, paste the contents of the private key file (endgame_rsa_key.p8) into the private key field. Submitting the form validates the credentials against Snowflake and stores them securely. Enter the private key only into this form — never send it by email or chat.

​
Why the account is read-only and scoped to one schema

This account’s grants are the boundary for everything Endgame does in your Snowflake. Endgame runs read queries against the mirror schema to discover its shape, then reads the mirror on a schedule. A read-only role scoped to the one schema is what guarantees Endgame can read your Salesforce mirror and nothing else. You set that boundary here, at the moment you create the account.