Manage programmatic access

• The Firebolt API - directly interacts with Firebolt’s data warehouse using HTTP requests.
• The Firebolt drivers - use a third party tool or programming language to integrate with Firebolt’s data warehouse. Firebolt supports several languages including Python, Node, .Net, and Go.

1. Create a service account.
2. Generate a secret.
3. Get a service account ID.

1. Test your new service account.
2. Edit your service account.
3. Delete your service account.

​

Create a service account

​

Create a service account using the UI

1. Select the Configure icon () in the left navigation pane to open the Configure Space.
2. Select Service accounts on the left sub-menu bar.
3. Select the + Create a service account button at the top right of the Configure Space.
4. In the Create a service account window that appears, enter the following:
   • Name - The name of the service account.
   • Network policy - A security feature that defines a list of allowed and blocked IP addresses or ranges to manage access at the organization level, login level, or for service accounts.
   • Description - A description for the service account.
5. Toggle Is organization admin to designate the service account as an account with administrative privileges in your organization. In Firebolt, the organization admin role provides full administrative privileges over the organization, allowing management of users, service accounts, network policies, and other organization-wide settings.
6. Select account and user in that account with which you want to associate this service account. Or select New user and fill user details.
7. Select Create to finish creating the service account.
8. After creating service account generate Secret

​

Create a service account using SQL

1. Select the Develop icon (</>).
2. By default, when you login to Firebolt’s Workspace for the first time, Firebolt creates a tab in the Develop Space called Script 1. The following apply:
   • The database that Script 1 will run using is located directly below the tab name. If you want to change the database, select another database from the drop-down list.
   • An engine must be running to process the script in a selected tab. The name and status of the engine that Script 1 uses for computation is located to the right of the current selected database.
3. Select system from the drop-down arrow next to the engine name. The system engine is always running, and you can use it to create a service account. You can also use an engine that you create.
4. Use the syntax in the following example code to create a service account in the SQL Script Editor:
   Copy

   Ask AI

   CREATE SERVICE ACCOUNT IF NOT EXISTS "service_account_name" WITH DESCRIPTION = 'service account 1';
   

   For more information, see the CREATE SERVICE ACCOUNT command.

​

Get a service account ID

​

Generate a secret

​

Generate a secret using the UI

1. Select the Configure icon () in the left navigation pane to open the Configure Space.
2. Select Service accounts from the left sub-menu bar.
3. Select the three horizontal dots (…) to the right of the service account that you want to generate a secret.
4. Select Rotate secret.
5. Select the copy icon from the pop-up window New secret for service account that displays the new secret to copy the secret to your clipboard. This secret is not stored anywhere. Once you close the pop-up window, you will no longer be able to retrieve this secret.

​

Generate a secret using SQL

CALL fb_GENERATESERVICEACCOUNTKEY('service_account_name')

​

Create a user

​

Create a user using the UI

1. Select the Govern icon () in the left navigation pane to open the Govern Space.
2. Select Users from the left sub-menu bar.
3. Select the + Create User button at the top right of the Govern Space.
4. In the Create User window, enter the following:
   • User Name - The name of the user to associate with the service account.
   • Default Database - (Optional) The name of the database that is associated with the user.
   • Default Engine - (Optional) The name of the engine that is associated with the user.
   Toggle the radio button next to Associate a service account.
5. Select the name of the service account to associate with the user from the drop-down list under Service Account Associated. This drop-down list contains only service accounts that are not already assigned to a user in the current account.

​

Create a user using SQL

CREATE USER alex WITH SERVICE_ACCOUNT = service_account_name;

​

Test your new service account

curl -X POST --location 'https://id.app.firebolt.io/oauth/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'audience=https://api.firebolt.io' \
--data-urlencode "client_id=${service_account_id}" \
--data-urlencode "client_secret=${service_account_secret}"

{
  "access_token":"eyJz93a...k4laUWw",
  "token_type":"Bearer",
  "expires_in":86400
}

• The access_token is a unique token that authorizes your API requests that acts as a temporary key to access resources or perform actions. You can use this token to authenticate with Firebolt’s platform until it expires.
• The token_type is Bearer, which means that the access token must be included in an authorization header of your API requests using the format: Authorization: Bearer <access_token>.
• The token expires_in indicates the number of seconds until the token expires.

​

Edit your service account

​

Edit your service account using the UI

1. Select Configure icon () in the left navigation pane to open the Configure Space.
2. Select Service accounts from the left sub-menu bar.
3. Select the three horizontal dots (…) to the right of the service account that you want to edit.
4. Select Edit service account. In the Edit service account pop-up window, you can edit the following:
   • Name - The name of the service account.
   • Network policy - The network policy associated with the service account that defines whether an IP address is allowed or blocked from interacting with Firebolt resources.
   • Description - The description of the service account.
   • Is organization admin - Toggle on or off to identify the service account as an organizational admin.
   • Associate a user - Change user association for selected account.
   Select Save to keep your edits.

​

Edit your service account using SQL

ALTER SERVICE ACCOUNT service_account_name SET NETWORK_POLICY = my_network_policy

​

Delete your service account

​

Delete your service account using the UI

1. Select the Configure icon () in the left navigation pane to open the Configure Space.
2. Select Service accounts from the left sub-menu bar.
3. Select the three horizontal dots (…) to the right of the service account that you want to delete.
4. Select Delete service account.

​

Delete your service account using SQL

DROP SERVICE ACCOUNT service_account_name;