Direct Data Share: Inbound | Benchling Documentation

Inbound Direct Data Share imports tables from your Snowflake or Databricks account into Benchling as datasets. Once imported, a dataset behaves like any other dataset in Benchling. Scientists can reference it in notebook entries, feed it into analyses, and chart it alongside Benchling-native data.

This is the complement to outbound sharing. Outbound puts Benchling data in your warehouse; inbound puts your warehouse data in Benchling, where the science happens.

Getting Access

Inbound Direct Data Share is in beta. Reach out to your Benchling representative to request access; the setup below will be unavailable until then.

Source platforms

Inbound reads from two platforms: Snowflake and Databricks. Both follow the same shape (a gateway holding credentials, then a connection pointing at specific data), but the account-side setup differs. Jump to the section for your platform below.

When to use it

Inbound sharing suits data that your scientists need to see next to their experiments but that originates elsewhere:

Manufacturing and process data from an MES or historian
Assay results processed in your own pipelines before they reach Benchling
Reference datasets: compound libraries, target annotations, clinical metadata
Curated tables from your analytics team that scientists should consume rather than rebuild

It is a batch import, not a live view. Each import produces a dataset reflecting the table at the time it ran. For data that changes constantly and must always be current, query it in your own platform instead.

Snowflake

How it works

Benchling connects to your Snowflake account and takes a current snapshot of the table or tables you selected. It registers the result as a dataset in a Benchling folder you choose.

Snowflake writes directly to Benchling-managed storage. Benchling sends SQL and polls for completion.
Your Snowflake role governs what Benchling can read. Benchling runs USE ROLE with the role you configure at the start of every session. Snowflake’s own access control then decides what is visible.

Compute runs in your Snowflake warehouse, so imports consume your credits.

Prepare your Snowflake account

Do this before configuring anything in Benchling. You will create a service user with key-pair authentication. You will also create a role limited to the data you intend to share, and a warehouse for Benchling’s queries to run on.

1. Generate an RSA key pair

Snowflake requires key-pair authentication for service users. Generate an unencrypted PKCS#8 private key:

openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out <p8_key_filename> -nocrypt
openssl rsa -in <p8_key_filename> -pubout -out <pub_out_filename>

Benchling requires an unencrypted private key. There is no passphrase field. Treat `<p8_key_filename>` as a secret: restrict its file permissions, do not commit it, and delete your local copy once Benchling stores it.

2. Create the role, warehouse, and user

Grant the role access only to the schemas you intend to share. Starting narrow and widening later is far easier than the reverse.

USE ROLE ACCOUNTADMIN;
CREATE ROLE IF NOT EXISTS BENCHLING_SHARE_ROLE;
CREATE WAREHOUSE IF NOT EXISTS BENCHLING_SHARE_WH
  WAREHOUSE_SIZE = 'XSMALL'
  AUTO_SUSPEND = 60
  AUTO_RESUME = TRUE
  INITIALLY_SUSPENDED = TRUE;
GRANT USAGE ON WAREHOUSE BENCHLING_SHARE_WH TO ROLE BENCHLING_SHARE_ROLE;
-- Scope these to the data you actually want to share.
GRANT USAGE ON DATABASE MY_DATABASE                     TO ROLE BENCHLING_SHARE_ROLE;
GRANT USAGE ON SCHEMA   MY_DATABASE.MY_SCHEMA           TO ROLE BENCHLING_SHARE_ROLE;
GRANT SELECT ON ALL TABLES    IN SCHEMA MY_DATABASE.MY_SCHEMA TO ROLE BENCHLING_SHARE_ROLE;
GRANT SELECT ON FUTURE TABLES IN SCHEMA MY_DATABASE.MY_SCHEMA TO ROLE BENCHLING_SHARE_ROLE;
CREATE USER IF NOT EXISTS SVC_BENCHLING
  TYPE = SERVICE
  DEFAULT_ROLE = BENCHLING_SHARE_ROLE
  DEFAULT_WAREHOUSE = BENCHLING_SHARE_WH
  RSA_PUBLIC_KEY = '<your_public_key_contents>';
GRANT ROLE BENCHLING_SHARE_ROLE TO USER SVC_BENCHLING;

GRANT SELECT ON FUTURE TABLES means new tables in that schema become available without another grant. Leave it off if you want to approve each table explicitly.

3. Allow Benchling’s egress, if you use network policies

If your Snowflake account restricts access by IP, allow Benchling’s egress addresses. Ask your Benchling representative for the current list for your region, then add them to the policy on the service user:

CREATE NETWORK POLICY IF NOT EXISTS BENCHLING_SHARE_NETPOL
  ALLOWED_IP_LIST = ('<benchling_egress_ip_ranges>');
ALTER USER SVC_BENCHLING SET NETWORK_POLICY = BENCHLING_SHARE_NETPOL;

4. Note your account identifier

Find it in Snowsight under Admin → Accounts. It is normally <org-name>-<account-name>, for example myorg-prod. This is the value Benchling uses as the connection host, so it must be the account identifier, not the full URL and not the account locator.

Configure the connection in Benchling

Once Benchling enables inbound for your tenant, set it up in two steps: a gateway holding the credentials, then a connection pointing at specific data.

Create the Snowflake gateway

In Benchling Connect, add a gateway of type Snowflake and provide:

Field	Value	Required
Snowflake Account	Your account identifier, for example `myorg-prod`	Yes
Snowflake User	The service user, for example `SVC_BENCHLING`	Yes
Private key (PEM)	The full contents of `<p8_key_filename>`, including its `BEGIN` and `END` lines	Yes
Warehouse	The warehouse for Benchling’s queries, for example `BENCHLING_SHARE_WH`	No

Benchling stores the private key encrypted and never returns it via the API or shows it in the UI again. Benchling validates the account identifier and parses the key when you save, catching a typo or malformed key immediately instead of failing later.

Create the connection

Add a connection on that gateway, specifying which data to import and where it should land in Benchling:

Database, schema, and role: what to read, and which Snowflake role to assume. Benchling lists the tables this role can see so you can pick from them.
Benchling Location: the project or folder that receives the imported datasets.

You need Append access or higher on the destination project or folder for it to appear in the location picker. A project where you only have Read access is silently absent from the list. Registry folders are not selectable here.

Verify

After saving, confirm that Benchling can list tables from your Snowflake account: the connection shows the tables the role can see. If the list is empty or the connection reports an error, work through Troubleshooting below.

Then run an import and check that the dataset appears in the destination folder with the expected row and column counts.

Operating considerations

Warehouse sizing. COPY INTO unloads are I/O-bound, and an XSMALL warehouse handles typical table sizes. Size up only if unloads of your largest tables are slow; auto-suspend keeps idle cost near zero either way.

Credit usage. Imports run on your warehouse and consume your credits. If you are importing large tables on a frequent schedule, monitor it the way you would any other scheduled job in your account.

Column types. Data arrives as Parquet, so Snowflake types map to the dataset’s column types. Review a first import of any wide or unusual table to confirm the types came through as you expect, particularly for VARIANT, GEOGRAPHY, and high-precision numerics.

Row-level security and masking. Any row access policy or masking policy that applies to the role Benchling assumes applies to the import too. This is a useful way to share a filtered or redacted view of a sensitive table. Grant Benchling a role that sees only what scientists should see.

Credential rotation. To rotate the key pair, generate a new one, set RSA_PUBLIC_KEY_2 on the service user, update the private key on the Benchling gateway, then remove the old key. Snowflake supports two keys at once specifically so rotation needs no downtime.

Troubleshooting

“The Snowflake account identifier does not match a Snowflake account”: Benchling probes the account host when you save. Check the value against Admin → Accounts in Snowsight. Use the <org>-<account> identifier, not the full https:// URL. Benchling converts underscores to hyphens automatically, since it uses the identifier as a hostname.

“The private key must be a valid PEM-encoded private key”: paste the entire file including the BEGIN and END delimiter lines. The key must be unencrypted PKCS#8 and must be the private key, not the public one. Re-run the openssl commands above if you are unsure.

The table list is empty: the role cannot see any tables. Verify with USE ROLE BENCHLING_SHARE_ROLE; followed by SHOW TABLES IN SCHEMA MY_DATABASE.MY_SCHEMA; in Snowsight. Missing USAGE on the database or schema is the usual cause: SELECT on tables alone is not enough.

Your destination project is not in the location picker: you need Append access or higher on it. Read access is not sufficient, and this is a permission-tier check, so being a member of the project is not enough on its own. Registry-backed folders never appear here.

Imports fail with an authentication error: confirm the public key on the Snowflake user matches the private key in Benchling. In Snowsight, DESC USER SVC_BENCHLING shows the registered key fingerprint. If you recently rotated, the gateway may still hold the retired key.

Imports fail after a network policy change: Benchling’s egress addresses need to remain in the allowed list. Ask your Benchling representative to confirm the current ranges for your region, as they can change.

Databricks

How Databricks import works

Benchling reads from a Unity Catalog-governed schema in your Databricks workspace, authenticating as a service principal you create. The same two-step shape as Snowflake applies: a gateway in Benchling Connect holds the credentials. A connection on that gateway points at specific data and a destination Benchling Location.

Get started

Benchling enables Databricks inbound per tenant. Contact your Benchling representative to request it. They provide the account-side setup: the service principal, warehouse, and grants to create in your workspace. They also walk through the gateway and connection fields in Benchling Connect as part of enablement.