Connect a warehouse
A data source is your warehouse connection. Lighthouse supports Snowflake, BigQuery, Postgres, Redshift (through the Postgres connection), and SQL Server. All connections are read-only and require a successful test before saving.
Snowflake
Before connecting, create a read-only Snowflake user with USAGE on the warehouse, database, and schema you want to monitor, and SELECT on all tables within the schema.
- accountIdentifier
- RequiredYes
- DescriptionYour Snowflake account ID, e.g. xy12345.us-east-1
- username
- RequiredYes
- DescriptionRead-only Snowflake user
- password
- RequiredYes
- DescriptionPassword for the user (stored encrypted)
- warehouse
- RequiredYes
- DescriptionSnowflake virtual warehouse to use for queries
- database
- RequiredYes
- DescriptionDatabase containing the tables to monitor
- schema
- RequiredYes
- DescriptionSchema within the database
- role
- RequiredNo
- DescriptionSnowflake role to apply; defaults to the user's default role if omitted
CURRENT_WAREHOUSE(), CURRENT_DATABASE(), and CURRENT_SCHEMA() and verifies that the session values match the fields you entered. If your user's default warehouse, database, or schema differs from what you typed, the test will fail. Align the config fields with the user's actual session defaults, or specify a role that sets them correctly.BigQuery
BigQuery uses a service account JSON key for authentication. Create a service account in Google Cloud and grant it these three IAM roles: BigQuery Data Viewer (project level), BigQuery Job User (project level), and BigQuery Metadata Viewer on the specific dataset (dataset level, not just project level).
- projectId
- RequiredYes
- DescriptionGCP project ID where queries are billed and run
- schemaProjectId
- RequiredNo
- DescriptionGCP project where the dataset lives, if different from projectId
- dataSetName
- RequiredYes
- DescriptionBigQuery dataset name (just the name, not the full path)
- serviceAccountKey
- RequiredYes
- DescriptionFull service account JSON key: paste the entire JSON object
SELECT 1 and fetching dataset metadata. If the dataset test fails, verify the service account has the BigQuery Metadata Viewer permission on the specific dataset, not just project-level access.Postgres
Standard PostgreSQL connection. Create a read-only user with CONNECT on the database and SELECT on all tables in the target schema.
- host
- RequiredYes
- DescriptionHostname or IP of your Postgres server
- port
- RequiredYes
- DescriptionPort number: default is 5432
- username
- RequiredYes
- DescriptionDatabase user (read-only recommended)
- password
- RequiredYes
- DescriptionPassword for the user (stored encrypted)
- database
- RequiredYes
- DescriptionDatabase name
- schema
- RequiredYes
- DescriptionSchema name, e.g. public
- useSsl
- RequiredNo
- DescriptionShown in the connection form but not applied to the connection yet. Contact support if your warehouse requires SSL
SQL Server (MSSQL)
SQL Server uses standard SQL authentication: the same host/port/user/password pattern as Postgres. Create a read-only login with CONNECT on the database and SELECT on the tables in the target schema.
- host
- RequiredYes
- DescriptionHostname or IP of your SQL Server instance
- port
- RequiredYes
- DescriptionPort number: default is 1433
- username
- RequiredYes
- DescriptionSQL Server login (read-only recommended)
- password
- RequiredYes
- DescriptionPassword for the login (stored encrypted)
- database
- RequiredYes
- DescriptionDatabase name
- schema
- RequiredYes
- DescriptionSchema name, e.g. dbo
Redshift
Redshift is supported through the Postgres connection. Add a Postgres data source and enter your Redshift endpoint, port (default 5439), database, schema, and a read-only user with SELECT on the tables you want to monitor.
Testing the connection
Every time you create or edit a data source, you must click Test Connection before saving. Lighthouse runs a live test against your warehouse and blocks the save if the test fails.
The test is also re-run server-side on submit, so even if you pass the browser test, the server validates again before creating the data source record.
Editing a data source
You can update credentials or connection settings at any time from /data-sources. The connection test runs again on save. If you pause or delete a data source, any associated datasets and metrics will also pause.
Security
All credentials are stored encrypted at rest. Lighthouse never copies or replicates your tables. It keeps schema metadata (table names, column names, types), the values of columns you filter on, and the results of your metric runs, including the columns your metric query returns. When you ask the AI assistant or a connected agent to look at your data, it can read up to 100 rows per request. Those rows are sent to the AI provider that handles the request and may be kept in our AI request logs, as described in the Privacy Policy.
For more on our security posture and compliance status, see the Trust Center.
Troubleshooting
If your connection test fails, see Troubleshooting for common credential and network errors by warehouse type.