> ## Documentation Index
> Fetch the complete documentation index at: https://docs.outerproduct.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect your Snowflake account to your OuterProduct account

> Authenticate your OuterProduct account with Snowflake via Workload Identity Federation.

## Give your OuterProduct account permission to access your Snowflake account

We authenticate with Snowflake via [Workload Identity Federation](https://docs.snowflake.com/en/user-guide/workload-identity-federation), an OAuth-token-based authentication flow.

<Steps>
  <Step title="Open the New Connector wizard">
    Log in to [console.outerproduct.com](https://console.outerproduct.com) and navigate to **Connectors**. Click **New Connector**, give your connector a name, and select **Snowflake**.
  </Step>

  <Step title="Enter your Snowflake account identifier">
    Enter your Snowflake \[account identifier]\([https://docs.snowflake.com/en/user-guide/admin-account-identifier](https://docs.snowflake.com/en/user-guide/admin-account-identifier)).
  </Step>

  <Step title="Run the generated setup SQL">
    Copy the SQL from the connector wizard and run it in a Snowflake worksheet with a role that can create service users, such as `ACCOUNTADMIN`. The SQL creates a Snowflake `SERVICE` user that trusts OuterProduct's OIDC workload identity.

    ```sql expandable theme={null}
    CREATE USER IF NOT EXISTS IDENTIFIER('OUTERPRODUCT_<ID>')
      TYPE = SERVICE
      WORKLOAD_IDENTITY = (
        TYPE = OIDC
        ISSUER = 'https://<redacted>.tokens.sts.global.api.aws'
        SUBJECT = 'arn:aws:iam::<redacted>:user/outerproduct-backend-runtime'
        OIDC_AUDIENCE_LIST = ('outerproduct:snowflake:org:<org-id>:account:<snowflake-account>:connector:<connector-name>')
      )
      DEFAULT_ROLE = PUBLIC;
    ```

    Do not edit the generated user name, issuer, subject, or audience.
  </Step>

  <Step title="Save the connector">
    Return to the connector wizard and click **Add connector**. OuterProduct validates the workload identity login before saving the connector.
  </Step>
</Steps>

The generated SQL only sets up login. The service user still needs whatever Snowflake privileges your organization requires to read the tables you register.

## Use it from Python

Once your connector is saved in the Console, register the Snowflake table as a source table with `ws.register_snowflake`. Pass a table name, the source locator in `DATABASE.SCHEMA.TABLE` form, and the `connector` name from the Console. The call returns a `DataFrame` you can train on, or query later with `ws.table(name)` or `ws.sql(...)`.

```python theme={null}
import outerproduct as op

op.init()  # reads OUTERPRODUCT_API_KEY from the environment
ws = op.Workspace()

ws.register_snowflake("customers", "MYDB.PUBLIC.CUSTOMERS", connector="prod-snowflake")

# Build the training set as a query over the registered source.
train = ws.table("customers").filter(op.col("signup_year") >= 2020)

model = op.reasoning.fit(train, task=op.Binclass(label_column="churn")).wait()
```