In dbt Cloud, navigate to Account Settings > Service Tokens and create a token with the Semantic Layer Only permission set
Locate your environment ID from the Semantic Layer configuration page in your dbt Cloud project settings
Download the ArrowFlight SQL JDBC driver version 12.0.0 or higher from Maven and add it to your BI tool's driver directory
Configure the JDBC connection string in the format: jdbc:arrow-flight-sql://semantic-layer.cloud.getdbt.com:443?environmentId=YOUR_ENV_ID&token=YOUR_TOKEN
If connecting from behind a corporate VPN or proxy, append &disableCertificateVerification=true to address potential ALPN negotiation failures, then test with a simple metric query
Known gotchas
The dbt Semantic Layer JDBC API uses the gRPC/HTTP2 protocol over port 443; firewalls that block HTTP2 or perform TLS inspection will break the connection even when the URL looks correct
Each service token can be linked to only one credential per project; if multiple teams need different warehouse permissions, create separate tokens mapped to separate credentials
ArrowFlight SQL driver versions below 12.0.0 are not supported by the Semantic Layer JDBC endpoint; an older driver version will fail authentication or produce protocol errors
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp