Snowflake

In Snowsight, open Projects → Worksheets, create a worksheet, and run:

SELECT LOWER(CURRENT_ORGANIZATION_NAME() || '-' || CURRENT_ACCOUNT_NAME())
  AS account_identifier;

Copy the result — this is the Account Identifier you’ll enter in StackSpend (e.g. my-org-my-account). Older accounts may instead use the accountlocator.region form (e.g. xy12345.us-east-1).

First switch to the ORGADMIN role. Run this on its own and confirm it succeeds:

USE ROLE ORGADMIN;

If that errors with “Role ‘ORGADMIN’ does not exist or not authorized,” your login hasn’t been granted ORGADMIN — ask whoever set up the Snowflake organization to grant it (GRANT ROLE ORGADMIN TO USER <your_user>;) or to run Steps 2–4 for you.

Then confirm the role is active and the billing view is reachable:

SELECT CURRENT_ROLE();

SHOW VIEWS LIKE 'USAGE_IN_CURRENCY_DAILY'
  IN SCHEMA SNOWFLAKE.ORGANIZATION_USAGE;

CURRENT_ROLE() should return ORGADMIN, and the second query should return one row. If it still errors after you’re confirmed on ORGADMIN, this account doesn’t expose org billing data (see prerequisites).

Finally, list your warehouses and note one to use:

SHOW WAREHOUSES;

Pick any one warehouse (a small X-Small is ideal). It’s only the engine that runs the billing queries — it does not limit what’s read, so it doesn’t matter which you choose.

Switch to ACCOUNTADMIN to create the user and role. Run each statement individually, in order — if you run them as one block, later lines fail with “User … does not exist.”

USE ROLE ACCOUNTADMIN;

CREATE USER IF NOT EXISTS stackspend_service_user
  DEFAULT_WAREHOUSE = YOUR_WAREHOUSE
  COMMENT = 'Read-only billing user for StackSpend';

CREATE ROLE IF NOT EXISTS stackspend_billing_reader;

GRANT USAGE ON WAREHOUSE YOUR_WAREHOUSE TO ROLE stackspend_billing_reader;

GRANT ROLE stackspend_billing_reader TO USER stackspend_service_user;

ALTER USER stackspend_service_user SET DEFAULT_ROLE = stackspend_billing_reader;

Confirm the user was created:

SHOW USERS LIKE 'STACKSPEND_SERVICE_USER';

Now grant the billing views to the role. This usually works as ACCOUNTADMIN; if it’s denied, run USE ROLE ORGADMIN; first, then re-run the grant:

GRANT DATABASE ROLE SNOWFLAKE.ORGANIZATION_BILLING_VIEWER
  TO ROLE stackspend_billing_reader;

Key-pair authentication is recommended for long-lived machine access. In your terminal, move into a known folder first so you can find the files afterwards (we use ~/Downloads here), then generate an unencrypted PKCS#8 private key and its public key:

cd ~/Downloads
openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out rsa_key.p8 -nocrypt
openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub

Both files are now in ~/Downloads. Snowflake wants the public key as a single line with no header/footer — print exactly that and copy the output:

grep -v "PUBLIC KEY" ~/Downloads/rsa_key.pub | tr -d '\n'

Back in Snowsight (as ACCOUNTADMIN), register it on the service user — paste the single-line key between the quotes:

ALTER USER stackspend_service_user
  SET RSA_PUBLIC_KEY = '<paste single-line public key>';

Confirm it took — look for a non-null RSA_PUBLIC_KEY_FP fingerprint:

DESC USER stackspend_service_user;

In StackSpend, go to Providers → Snowflake and enter:

Click Test Connection to confirm billing access, then Save to begin the first sync.

The first sync fetches up to 90 days of billed currency history from USAGE_IN_CURRENCY_DAILY. Data appears in StackSpend within minutes of the sync completing.