Configuration & Setup

---

Deployed Components & Features

The Ekai Native App deploys the following onto your Snowflake account:

Snowpark Container Services

Service	Purpose
Web	UI frontend
Backend	Connects application services
AI Core	AI functions for schema understanding
Document Worker	Processes document indexing and embedding generation for semantic search
Profiling Worker	Handles data profiling operations and statistical analysis of database schemas
Support services	Neo4J, Redis, Postgres — for knowledge graphs, agent memory, and app data

External Access Integration (EAI) - OPTIONAL

A limited-scope EAI is configured to enable enterprise LLMs. It requests access to:

• Snowflake Computing
• AWS Simple Email Service (account creation emails)
• Sendgrid (user invites and notifications)
• Google APIs
• Microsoft Azure OpenAI APIs
• DBT Package Hub & Git/GitHub (DBT dependencies)

Read more on EAI setup here.

Warehouse & Compute

• An XS warehouse EKAI_APP_WAREHOUSE is created and accessible by the app by default.
• An XS compute pool is created to run the Snowpark Container Services.

---

1. App Installation

Refer to the Installation guide for full steps.

---

2. App Configuration

2.1 LLM Configuration

Snowflake Cortex is the default and recommended LLM provider for the Snowflake Native App. Cortex runs models directly within your Snowflake environment using Native App Identity — no additional setup or credentials required.

Using External LLMs

To use Public APIs or Enterprise Cloud LLMs instead of Cortex, you must configure the External Access Integration (EAI) to enable outbound network access from the Native App.

For detailed LLM configuration options and setup steps, see the LLM Configuration guide.

---

2.2 Usage Configuration

ekai's usage limits (data connections, semantic models, tables, etc.) are configured per your plan. To activate, share your account identifier with the Ekai team by running:

SELECT CURRENT_ACCOUNT();

---

2.3 Data Access Configuration

Data connections are created from the Schema Agents section in the left panel. Ekai supports four authentication methods for connecting to Snowflake data:

• Native App Identity — uses the application's identity (recommended, no EAI required)
• User PAT — Personal Access Token authentication (requires EAI)
• OAuth — OAuth-based authentication (requires EAI)
• Key-Pair — Key-pair authentication (requires EAI)

To set up a connection using Native App Identity:

1. Click Add Data Connection in the upper right.

   

2. Select Native App Identity as the Authentication Type and fill in your connection details. Before clicking Next — ensure the app has access to relevant objects. You can do so with the queries in step 3 below.

   

3. Grant the app access to your warehouse, database, and schema by running the following SQL as ACCOUNTADMIN if needed:

-- Show Applications to confirm your app/name
SHOW APPLICATIONS;

-- Warehouse
GRANT USAGE ON WAREHOUSE <your-wh> TO APPLICATION <APPLICATION_NAME>;

-- Database
GRANT USAGE ON DATABASE <your-db> TO APPLICATION <APPLICATION_NAME>;

-- Schema
GRANT USAGE ON SCHEMA <your-db.schema> TO APPLICATION <APPLICATION_NAME>;

-- Tables
GRANT SELECT ON ALL TABLES
  IN SCHEMA <your-db.your-schema>
  TO APPLICATION <APPLICATION_NAME>;

-- Views
GRANT SELECT ON ALL VIEWS
  IN SCHEMA <your-db.your-schema>
  TO APPLICATION <APPLICATION_NAME>;

-- Dynamic Tables
GRANT SELECT ON ALL DYNAMIC TABLES
  IN SCHEMA <your-db.your-schema>
  TO APPLICATION <APPLICATION_NAME>;

-- Materialized Views
GRANT SELECT ON ALL MATERIALIZED VIEWS
  IN SCHEMA <your-db.your-schema>
  TO APPLICATION <APPLICATION_NAME>;

4. Click Next — your data connection is ready.

---

3. App Access Control

By default, only ACCOUNTADMIN (the app owner) has access. There are two ways to grant access to other users:

Option A — User Requests Access

1. After the ACCOUNTADMIN has installed the app, other users navigate to the app listing.

   

2. Instead of Get, they will see Request Access — clicking it notifies the app owner.

3. The app owner receives an email and navigates to App Settings → Access Management to grant the relevant application roles.

Option B — App Owner Grants Access in Advance

1. ACCOUNTADMIN opens Catalog → Apps → Active Apps and clicks the app listing to open its settings.

2. Navigate to the Access Management tab.

   

3. Click Add under Account roles with access and select the roles to grant from the popup.

   

Quickest path

Grant the EKAI_APP_USER application role to the PUBLIC role to give all users access in one step.