Connect MotherDuck to Rig

Before you start

• A MotherDuck account with an existing database that Rig should read.
• The ability to create access tokens in MotherDuck.
• A workspace owner, or a role with the Manage connections permission, in Rig.

Step 1: Create a MotherDuck access token

1. Go to the MotherDuck UI.
2. Click your organisation name at the bottom of the left sidebar, then click Settings.
3. Under Integrations, click Access Tokens, then click Create token.
4. Give the token a name you will recognise, such as Rig read.
5. Choose the token type. Tokens are Read/Write by default or Read Scaling. Pick Read Scaling for the read credential.
6. Choose whether the token expires, click Create token and copy the token.

Step 2: Create a second token if Rig should ingest

Skip this step if Rig only needs to read.

1. Repeat the steps above and choose Read/Write as the type, with a different name such as Rig write.
2. Rig refuses a write token that matches the read one.

Step 3: Connect it in Rig

Adding a source needs a workspace owner, or a role with the Manage connections permission, on a workspace where you manage your own connections. If the Connectors tab says “Data ingestion for this workspace is managed by Rig”, ask an owner or Rig support to add the source.

1. In Rig, open Connections. On a workspace with no warehouse yet, the page shows a Set up your warehouse card. Choose Bring your own warehouse.
2. If the workspace already has a warehouse, open the Warehouse stage, click Change warehouse, choose Bring your own and pick the type. Your connected sources and schedules are kept, and data already synced is not copied across, so re-sync afterwards.
3. Choose MotherDuck as the Warehouse type.
4. Database name: the MotherDuck database Rig should read, for example my_warehouse. It must already exist and be visible to the token.
5. MotherDuck token: paste the access token you copied.
6. The credential fields appear once for the read credential, labelled with a (read) suffix. Rig only reads your warehouse unless you add a write credential.
7. To let Rig also sync your connected tools into this warehouse, switch on Let Rig ingest data into this warehouse and fill the same credential fields again, now labelled (write / ingestion). The write credential must differ from the read one, and Rig blocks the form if they match.
8. Click Provision workspace. Rig stores the credentials in AWS Secrets Manager and does not echo them back.
9. To rotate a credential later, open the Warehouse stage and click Update credentials. Fill in only what you want to change and leave the rest blank.

What Rig reads

• Schemas, tables and views: Rig reads the structure of the database you name and builds its context layer from it.
• dbt models: Tables that dbt builds are read like any other table, with dbt lineage kept alongside them.
• Query results: Questions run as DuckDB SQL on MotherDuck, and results go to the person asking.
• Ingested sources: Only if you add a Read/Write token, Rig also creates schemas for the tools you sync.

With only a Read Scaling token Rig cannot create or change tables.

Good to know

• This guide is for a MotherDuck account you own. If you pick Rig-hosted warehouse instead, Rig provisions a private MotherDuck database for you and there is no token to create.
• A MotherDuck database name that starts with a number cannot be connected to directly, so rename it first.
• You can set a token to expire. When it does, create a new one and enter it with Update credentials.
• The token is stored in AWS Secrets Manager and is never logged.

What people use this for

• Run fast exploratory analytics in plain English
• Query Parquet and CSV files alongside warehouse tables
• Serve MotherDuck to Claude, Cursor and ChatGPT
• Keep DuckDB queries validated and bounded

More ideas for using MotherDuck

MotherDuck documentation

• Authenticating to MotherDuck