Skip to main content
Personal warehouse credentials allow you to connect to your data warehouse using your own individual credentials instead of shared project credentials. This provides better security and audit trails for data access.

​
When are personal warehouse credentials used?

Your personal warehouse credentials are used for every query you run in a project, including charts, dashboards, Explore, the SQL runner, and AI agents (Ask AI), when:
  • The project is configured to require user credentials for data access, or
  • The project uses a shared connection that accepts personal credentials. Databricks and Trino projects always do. BigQuery projects do when Use personal credentials when available is turned on under Advanced configuration options in the project’s BigQuery connection settings.
On a shared connection that accepts personal credentials, adding them is optional. Lightdash doesn’t ask you to add any, and people who haven’t added them keep using the shared project connection. If your personal credentials can’t read a table that the shared connection can, you get the warehouse’s permission error for that table even though others don’t. Remove your credentials under Settings → My warehouse connections to go back to the shared connection. When you have credentials for the project’s warehouse type, the Warehouse credentials button in the navigation bar lets you pick which ones to use. On a shared connection that accepts personal credentials, the button only appears once you’ve added them, so if it’s missing, your queries use the shared connection. Every other project uses the shared project connection. On a project with multiple warehouse connections, you choose credentials for each connection in the credentials switcher in the navigation bar. When a project is created with organization credentials but also requires user credentials, your personal credentials override the organization credential for your own queries.
If your personal sign-in has expired or fails, Ask AI doesn’t show the reconnect prompt that charts, dashboards and Explore show. It replies with text only, for example that the warehouse connection has expired, and that wording can tell you to ask your data team instead of pointing you at your own settings. Reconnect under Settings → My warehouse connections, then ask your question again.

​
Setting up personal warehouse credentials

To configure your personal warehouse credentials:
  1. Navigate to your user settings by clicking on your profile in the top right corner
  2. Go to My warehouse connections and click Add credentials
  3. Set Warehouse to your project’s warehouse type. It starts on PostgreSQL, so for BigQuery change it to BigQuery to get Sign in with Google
  4. Enter your individual warehouse connection details
  5. Save your credentials
Personal warehouse credentials settings page

​
Supported authentication methods

Depending on your warehouse type, you can authenticate using different methods:

​
Snowflake

  • Sign in with Snowflake (OAuth): Use your Snowflake account to authenticate via OAuth. This requires your organization to have configured a Snowflake security integration. See Snowflake connection setup for details.
  • Private Key: Authenticate using a private key file.
  • Password: Use your Snowflake username and password.

​
Databricks

  • Sign in with Databricks (OAuth): Use your Databricks account to authenticate via OAuth. This requires your organization to have configured a Databricks OAuth application. See Databricks connection setup for details.
  • Personal Access Token: Use a Databricks personal access token.

​
BigQuery

  • Sign in with Google (OAuth): Use your Google account to authenticate via OAuth.
  • Service Account: Use a service account JSON key file.

​
Redshift

  • Sign in with AWS: Use your AWS IAM Identity Center account to authenticate in the browser. This requires the project connection to be configured with AWS IAM Identity Center settings. See Redshift connection setup for details.
  • AWS IAM (CLI credentials): Paste temporary AWS credentials from your CLI or SSO profile when the project requires personal warehouse credentials.
  • Password: Use your Redshift username and password.

​
Athena

  • Access keys: Use your own AWS access key ID and secret access key. This is the only sign-in method for personal Athena credentials.

​
Other warehouses

For other warehouse types (Postgres, Trino, ClickHouse), authentication is typically done using username and password credentials.

​
With agent identity on

When the agent identity feature flag is on, a personal warehouse credential can set sign-in fields only. The host, port, database, compute, TLS, SSH tunnel and policy settings always come from the project connection. Lightdash refuses to save a personal credential that sets any other field, and the error names the fields. Lightdash refuses to save a BigQuery service account key file, and a Redshift IAM credential with a role but no AWS access key of your own. Some saved credentials stop working when the flag turns on. Queries with them fail with: “Your saved warehouse credentials can no longer be used with this connection. Reconnect your credentials and try again.” Lightdash never falls back to the shared project credentials. Reconnect your credentials under Settings → My warehouse connections. This affects:
  • A Databricks sign-in saved without a workspace host, or for a different workspace host than the connection.
  • A Databricks credential that uses a service principal (machine-to-machine) sign-in.
  • A Redshift IAM credential that has a role but no AWS access key of your own.
  • An Athena credential that has a session token.
  • A credential for a different warehouse type than the project connection.
  • A MotherDuck token used with a DuckDB connection that is not MotherDuck.
Other saved credentials keep working. Lightdash ignores any extra fields on them, such as a host, database, warehouse or role, and uses the connection’s values instead.