How to configure codegen credentials

If semolina codegen could not reach your warehouse in Generate models from your warehouse, this is the page that fixes it. The CLI does not read credentials from quite the same place your application does.

semolina codegen connects to your warehouse to introspect semantic views. It reads the same .semolina.toml file your application engines use, and the same SNOWFLAKE_* / DATABRICKS_* environment variables and optional .env file fill any field the section omits.

It does not read the same section. --backend snowflake reads [connections.snowflake] and --backend databricks reads [connections.databricks]: the section name matches the backend. create_engine(), by contrast, defaults to [connections.default] and takes any section name you pass it.

--backend duckdb reads no TOML at all. It builds its config from --database or DUCKDB_DATABASE alone, so a [connections.duckdb] section has no effect on codegen even though create_engine() reads one.

Warning

A .semolina.toml containing only [connections.default] is enough for your application and not enough for Snowflake or Databricks codegen, which exits 2 with “connection config missing or invalid”. Add a backend-named section alongside it. The two can hold different credentials, which is useful when codegen runs under a read-only role.

Configure in .semolina.toml

.semolina.toml
[connections.snowflake]
type = "snowflake"
account = "xy12345.us-east-1"
user = "svc_codegen"
password = "..."
database = "analytics"
warehouse = "compute_wh"
# role = "codegen_role"

For key-pair auth, drop password and point at your private key:

.semolina.toml
[connections.snowflake]
type = "snowflake"
account = "xy12345.us-east-1"
user = "svc_codegen"
private_key_path = "/keys/rsa_key.p8"
# private_key_passphrase = "..."
database = "analytics"
warehouse = "compute_wh"

Note

database and warehouse are optional

account is the only field SnowflakeConfig requires. Leave database out and you have to name the view in full, database.schema.view, because introspection issues SHOW COLUMNS IN VIEW. Leave warehouse out and your user’s default warehouse runs the query. Set database whenever you set schema: the Snowflake driver ignores a schema given without one. See Snowflake.

.semolina.toml
[connections.databricks]
type = "databricks"
host = "workspace.cloud.databricks.com"
http_path = "/sql/1.0/warehouses/abc123"
token = "dapi..."
catalog = "main"

DuckDB codegen takes no TOML section. Give it the database path on the command line instead:

semolina codegen sales_view --backend duckdb --database /path/to/warehouse.db

semolina codegen my_schema.sales_view --backend snowflake

Configure with environment variables

Each field also reads from a prefixed environment variable, so you can skip the TOML file entirely. Values in [connections.<backend>] take precedence over the environment, which takes precedence over a .env file.

Variable

Required

Description

SNOWFLAKE_ACCOUNT

Yes

Account identifier with region (e.g. xy12345.us-east-1)

SNOWFLAKE_USER

Usually

Snowflake username. Needed by every auth method except workload identity

SNOWFLAKE_PASSWORD

One of

Password (or use key-pair below)

SNOWFLAKE_PRIVATE_KEY_PATH

One of

Path to a PKCS1 or PKCS8 private key file (key-pair auth)

SNOWFLAKE_PRIVATE_KEY_PASSPHRASE

No

Passphrase for an encrypted private key

SNOWFLAKE_WAREHOUSE

Recommended

Compute warehouse name. Without it, your user’s default warehouse runs the introspection query

SNOWFLAKE_DATABASE

Recommended

Database name. Without it, name the view in full (see the note above)

SNOWFLAKE_ROLE

No

Role to activate for the session

 
export SNOWFLAKE_ACCOUNT="xy12345.us-east-1"
export SNOWFLAKE_USER="svc_codegen"
export SNOWFLAKE_PASSWORD="..."
export SNOWFLAKE_DATABASE="analytics"
export SNOWFLAKE_WAREHOUSE="compute_wh"

semolina codegen my_schema.sales_view --backend snowflake

Variable

Required

Description

DATABRICKS_HOST

Yes

Workspace hostname (e.g. workspace.cloud.databricks.com)

DATABRICKS_HTTP_PATH

Yes

SQL warehouse HTTP path (e.g. /sql/1.0/warehouses/abc123)

DATABRICKS_TOKEN

Yes

Personal access token (starts with dapi)

DATABRICKS_CATALOG

No

Unity Catalog name. Without it, the workspace’s default catalog applies

 
export DATABRICKS_HOST="workspace.cloud.databricks.com"
export DATABRICKS_HTTP_PATH="/sql/1.0/warehouses/abc123"
export DATABRICKS_TOKEN="dapi..."

semolina codegen main.analytics.orders_view --backend databricks

Note

These match the names used by the connection pools (DATABRICKS_HOST, DATABRICKS_TOKEN), so a single set of variables drives both codegen and your application.

DuckDB needs no authentication. Pass the database path directly, or set DUCKDB_DATABASE:

semolina codegen sales_view --backend duckdb --database /path/to/warehouse.db
# or
export DUCKDB_DATABASE="/path/to/warehouse.db"
semolina codegen sales_view --backend duckdb

The --database flag takes precedence over DUCKDB_DATABASE. With neither set, codegen exits 2 and tells you to set one: there is no in-memory default, because an empty in-memory database has no view to introspect.

Use a .env file

Place the same prefixed variables in a .env file in your working directory and codegen picks it up automatically:

.env
SNOWFLAKE_ACCOUNT=xy12345.us-east-1
SNOWFLAKE_USER=svc_codegen
SNOWFLAKE_PASSWORD=...
SNOWFLAKE_DATABASE=analytics
SNOWFLAKE_WAREHOUSE=compute_wh

Point at a .env file elsewhere with SEMOLINA_ENV_FILE:

export SEMOLINA_ENV_FILE="/path/to/staging.env"
semolina codegen my_schema.sales_view --backend snowflake

Troubleshooting

Exit code 2: connection config missing or invalid

Codegen could not assemble connection config for the backend. On Snowflake and Databricks, check that the [connections.<backend>] section exists (with a matching section name), or that the required environment variables are set and spelled correctly. On DuckDB, the same exit code means neither --database nor DUCKDB_DATABASE gave it a path.

Exit code 4: connection failure

Codegen assembled config but could not authenticate or reach the warehouse. Check that credentials are valid (try your warehouse’s CLI), the key-pair path is readable, and network access is available (VPN, firewall rules). On DuckDB, exit 4 means the --database file does not exist or is not a DuckDB database. Codegen opens it read-only, so it never creates one.

Exit code 6: the view could not be described

Codegen connected, but the warehouse could not describe the view. The usual cause is a view whose definition no longer binds, such as one that reads a column since dropped from its source table. Your credentials are fine; fix or recreate the view.

See also