Snowflake OAuth 2.0 connector profile – StackOne setup guide

Sign in to your Snowflake account.

• In the left sidebar, go to Projects > Workspaces.
• Click + Add new to create a new SQL worksheet.

Run the following SQL, replacing <integration_name> with a name of your choice (e.g., STACKONE_OAUTH), <callback_url> with the Callback URL from your Connector Profile, and <role_name> with the Snowflake role your users will authorize with.

CREATE SECURITY INTEGRATION <integration_name>
  TYPE = OAUTH
  OAUTH_CLIENT = CUSTOM
  OAUTH_CLIENT_TYPE = 'CONFIDENTIAL'
  OAUTH_REDIRECT_URI = '<callback_url>'
  ENABLED = TRUE
  OAUTH_ISSUE_REFRESH_TOKENS = TRUE
  OAUTH_REFRESH_TOKEN_VALIDITY = 7776000
  PRE_AUTHORIZED_ROLES_LIST = ('<role_name>');

• OAUTH_REFRESH_TOKEN_VALIDITY is in seconds — 7776000 equals 90 days
• The role in PRE_AUTHORIZED_ROLES_LIST must exactly match the Snowflake Role field.
• Example: if your users connect with the SYSADMIN role, use PRE_AUTHORIZED_ROLES_LIST = ('SYSADMIN') and enter SYSADMIN as the Snowflake Role
• To find a role: your current role is shown next to your username in the bottom-left corner of Snowsight (e.g., ACCOUNTADMIN). Note that ACCOUNTADMIN, SECURITYADMIN, ORGADMIN, and GLOBALORGADMIN are blocked for OAuth — pick a non-blocked role such as SYSADMIN

In the same worksheet, run the following SQL, replacing <INTEGRATION_NAME> with your integration name in uppercase, wrapped in single quotes.

SELECT SYSTEM$SHOW_OAUTH_CLIENT_SECRETS('<INTEGRATION_NAME>');

The result is a JSON object containing your client credentials. Store them securely for use later.

• oauth_client_id is your OAuth Client ID
• oauth_client_secret is your OAuth Client Secret