Pilot quick start

A pilot connects one or two sources and puts Nexatron in front of a few people. This guide sets up a Snowflake connection where each person signs in with their own Snowflake login.

It needs two people: a Nexatron workspace admin and your Snowflake admin.

No identity-provider integration with Nexatron is needed for a pilot. People sign in to Nexatron with an email invite. They sign in to Snowflake on Snowflake's own login page. If your Snowflake already sends its login through your identity provider, that keeps working, because Nexatron never sees that step.

How access works

• The workspace admin turns each connection on for Everyone, for Selected groups and people, or for No one yet, and can revoke sign-ins at any time.
• People see only the connections turned on for them.
• Every answer runs as the person who asked, under their own Snowflake roles and row access policies.
• The connection's setup identity reads metadata only. It never answers a question.
• Admins get no bypass. Managing a connection does not need it turned on for you, but asking about it does. To try a connection, turn it on for yourself or a test group.

Who does what

Who	What
Workspace admin	Adds the Snowflake connection
Snowflake admin	Runs one statement that Nexatron generates, then sends back two values
Workspace admin	Pastes the two values, turns the connection on and invites people
Each person	Accepts the invite, clicks Connect Snowflake and signs in to Snowflake

Admin: add the connection

1. Open Connections → New connection → Snowflake.
2. Enter the account identifier in the orgname-accountname form. Find it in Snowsight under your name → Account → View account details. A Snowsight address or an <account>.snowflakecomputing.com address also works.
3. Enter the warehouse, the database and the setup user's key pair. The setup user needs metadata access only: table and column names, query history and governance metadata. It never answers anyone's question.
4. Save, then open the new connection's page.
5. Under Who signs in, leave Each person signs in with their own Snowflake login selected. It is the default for a new Snowflake connection.
6. Under Who can use it, choose No one yet if you want to finish setup before anyone can ask.

Snowflake admin: create the sign-in integration

On the connection's page, Snowflake sign-in asks for the account identifier. Click Show the statement. Nexatron fills in this connection's values. The statement looks like this:

-- Run once in Snowsight as ACCOUNTADMIN (or a role with CREATE INTEGRATION on the account).
-- It lets each person sign in to Nexatron with their own Snowflake login; their questions then run as
-- them, under their own roles and row access policies. It grants Nexatron no data access of its own.
CREATE SECURITY INTEGRATION IF NOT EXISTS NEXATRON_OAUTH_<CONNECTION_KEY>
  TYPE = OAUTH
  ENABLED = TRUE
  OAUTH_CLIENT = CUSTOM
  OAUTH_CLIENT_TYPE = 'CONFIDENTIAL'
  OAUTH_REDIRECT_URI = 'https://nexatron.io/connections/<CONNECTION_ID>/snowflake-callback'
  OAUTH_ENFORCE_PKCE = TRUE
  OAUTH_ISSUE_REFRESH_TOKENS = TRUE
  OAUTH_REFRESH_TOKEN_VALIDITY = 7776000
  OAUTH_USE_SECONDARY_ROLES = IMPLICIT
  BLOCKED_ROLES_LIST = ('ACCOUNTADMIN', 'SECURITYADMIN', 'ORGADMIN');

-- Then copy OAUTH_CLIENT_ID and OAUTH_CLIENT_SECRET from this result into Nexatron:
SELECT SYSTEM$SHOW_OAUTH_CLIENT_SECRETS('NEXATRON_OAUTH_<CONNECTION_KEY>');

<CONNECTION_KEY> and <CONNECTION_ID> are placeholders. Copy the statement from Nexatron, not from this page: the integration name and the redirect URI belong to one connection.

1. Run the statement in Snowsight as ACCOUNTADMIN, or as a role with CREATE INTEGRATION on the account. It creates a sign-in client. It grants Nexatron no data access of its own.
2. The SELECT returns OAUTH_CLIENT_ID and OAUTH_CLIENT_SECRET. Send both to the workspace admin over a channel you trust.

What the settings do:

Setting	What it does
OAUTH_CLIENT = CUSTOM, OAUTH_CLIENT_TYPE = 'CONFIDENTIAL', OAUTH_ENFORCE_PKCE = TRUE	Nexatron is a server-side client. Every sign-in uses an authorization code with PKCE.
OAUTH_REDIRECT_URI	Snowflake sends people back only to this connection's page in Nexatron.
OAUTH_REFRESH_TOKEN_VALIDITY = 7776000	A person stays signed in for up to 90 days, then signs in again. Nexatron renews the short-lived access token in between.
OAUTH_USE_SECONDARY_ROLES = IMPLICIT	Questions use the person's default role plus their other granted roles, as in Snowsight.
BLOCKED_ROLES_LIST	ACCOUNTADMIN, SECURITYADMIN and ORGADMIN can never be used through Nexatron. Snowflake blocks them by default; listing them keeps the block if that default is changed. Nexatron also refuses a token that carries one of them.

Nexatron asks Snowflake for one scope, refresh_token. It never asks for a role scope.

Admin: turn it on and invite people

1. Under Snowflake sign-in, paste the Client ID and Client secret, then click Save and turn on sign-in. The secret is stored encrypted and is not shown again.
2. Under Who can use it, choose Everyone or Selected groups and people. Groups are your workspace roles. Click Save access.
3. Open Members & roles (under Admin → Identity) and click Invite user for each person. They set a Nexatron password from the invite. No single sign-on is needed.

Each person: connect once

1. Accept the invite and sign in to Nexatron.
2. Ask a question about the Snowflake data. The first time, Nexatron shows Connect Snowflake. The same button is under Settings → Connected accounts.
3. Sign in on Snowflake's login page. If your company signs in to Snowflake through single sign-on, Snowflake sends you there as usual.
4. Back in Nexatron, ask again. The answer runs as you.

When the sign-in ends, after 90 days or because a Snowflake admin revoked it, Nexatron shows Reconnect Snowflake instead of failing. To stop using your Snowflake login yourself, click Disconnect Snowflake under Settings → Connected accounts.

Take access away

• Turn the connection off. Under Who can use it, choose No one yet, or remove a group or person, and click Save access. From their next question, dashboard tile, schedule or MCP call, the connection is no longer read for them.

• Revoke sign-ins. Under Signed in now, click Revoke next to a person, or Revoke everyone's sign-in. This ends their Snowflake sign-ins on the connection and deletes the stored tokens. People the connection is still turned on for can connect again.

• Stop it in Snowflake. Your Snowflake admin can disable the integration, which stops every sign-in at the source:

  ALTER SECURITY INTEGRATION NEXATRON_OAUTH_<CONNECTION_KEY> SET ENABLED = FALSE;

Each change is recorded in the audit log: turning a connection on or off (connection.access.enabled, connection.access.disabled), a person connecting (connection.credential.connected), a revoke (connection.credential.revoked), and saving the sign-in client or changing the sign-in mode (connection.update).

What your identity team does not need to do

A pilot does not involve your identity team:

• No Okta, Microsoft Entra ID, Ping or RSA setup for Nexatron.
• No single sign-on app for Nexatron. People sign in with an email invite.
• No user provisioning. The workspace admin invites people by email.
• No External OAuth setup in Snowflake.
• No change to how people sign in to Snowflake today.

Salesforce

Salesforce connections also use per-person sign-in. Each person clicks Connect Salesforce on the connection's page in Nexatron and signs in on Salesforce's own page. Answers run as that person, so Salesforce's own permissions decide what they see. Who can use it and revoking work the same way as for Snowflake.

Fallback: mapped users with a key pair

If you cannot create a security integration, set Who signs in to Users your admin maps. The workspace admin then links each person to a Snowflake user under Who people answer as, and Nexatron answers as that user with the connection's key pair. Changing the sign-in mode ends the connection's personal sign-ins.

Later: single sign-on pass-through

Single sign-on pass-through, using Snowflake External OAuth through your identity provider (Okta, Microsoft Entra ID or Ping), is a later add-on. It is never needed for a pilot or to connect a source.