> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ones1ght.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SFTP Connection

> Connect so that large files on the SFTP server can be read directly

## What is an SFTP Connection?

When you place large files that are hard to upload through the browser on an SFTP server, OneSight reads them directly at query time. Files are not copied or stored, so replacing the original takes effect starting with the next query.

The connection is encrypted over SSH. Plain FTP, which is not encrypted, is not supported.

<Note>
  Only users with **Admin** privileges can register a data source. Issuing the server account (Step 1) must be handled by the person who manages that server.
</Note>

## What You'll Need

* The server's **address** and **port** (default `22`)
* A **read-only** account and that account's **password** or **SSH private key**
* The **path** to the files you want to read

## Step 1: Prepare a Read-Only Account (Server)

OneSight only performs **listing** and **reading** of files. It does not upload or delete files, so use an account without write permissions.

<Steps>
  <Step title="Create a Dedicated Account">
    Create a separate account used only for the OneSight connection. Keeping it from being shared with other purposes makes it easier to revoke access later.
  </Step>

  <Step title="Grant Access to Only the Required Path">
    Grant read permission only to the directory containing the data files. If possible, we recommend restricting the account (e.g., with chroot) so it cannot leave that directory.
  </Step>

  <Step title="Choose an Authentication Method">
    Use either a password or an SSH private key. For security, **an SSH private key is recommended**.
  </Step>
</Steps>

<Warning>
  If you use an SSH private key, it must be a key **without a passphrase**. Keys with a passphrase will fail to connect, and the cause isn't shown — it just appears as an authentication failure.
</Warning>

## Step 2: Connect to OneSight

<Steps>
  <Step title="Select Storage">
    Choose **Data Sources → Add → Storage → SFTP**.
  </Step>

  <Step title="Enter Connection Details and Connect">
    Enter the items below and verify the connection.

    | Field                  | Description                                       |
    | ---------------------- | ------------------------------------------------- |
    | Host                   | Server address                                    |
    | Port                   | Default `22`                                      |
    | User                   | The account created in Step 1                     |
    | Authentication method  | Password or SSH private key                       |
    | Password / Private key | For a private key, paste the entire file contents |

    The password and private key you enter are **encrypted with AES-256-GCM before being stored** at registration, and are never shown on screen again.
  </Step>

  <Step title="Select a File">
    Click a folder to navigate, then select the file to use. For SQLite (`.db`) files, next choose the **table** to query.
  </Step>

  <Step title="Review and Register">
    Check the data in the preview, review the automatically suggested mapping, then give it a name and register it.
  </Step>
</Steps>

## If the Connection Fails

<Accordion title="The Server Is on an Internal Network or VPN">
  The server must be an **address reachable from outside**. Addresses that are only reachable within an internal network or VPN are blocked by security policy. In this case, work with the person who manages the server to set up an external access path.
</Accordion>

<Accordion title="The Firewall Restricts IP Addresses">
  If the server is configured to allow only certain IPs, you'll need to add OneSight's server address to the allowlist. Please request the IP to allow through [Contact Us](/en/support/tickets).
</Accordion>

<Accordion title="Authentication Fails Even Though I Entered a Private Key">
  Check whether the key has a passphrase set. Keys with a passphrase are not supported. Also, be sure to paste the **entire file contents** of the private key, including the header and footer lines.
</Accordion>

## Supported File Types and Size Limits

| Type                    | Size Limit                                       |
| ----------------------- | ------------------------------------------------ |
| CSV                     | No limit — reads up to the first 4MB of the file |
| Excel (`.xlsx`, `.xls`) | 32MB                                             |
| JSON                    | 32MB                                             |
| SQLite (`.db`)          | 256MB                                            |

Excel, JSON, and SQLite have size limits because their formats require the entire file to be downloaded before it can be opened. A notice is shown at the registration step if the limit is exceeded.

## Next Steps

<CardGroup cols={2}>
  <Card title="Amazon S3 Connection" icon="database" href="/en/data-sources/s3">
    Connect S3 and S3-compatible storage
  </Card>

  <Card title="Contact Us" icon="message" href="/en/support/tickets">
    Contact us if you can't get connected
  </Card>
</CardGroup>