Connect Snowflake with OAuth 2.0 (Account-level) – StackOne Hub

Sign in to your Snowflake account and open Projects > Workspaces > + Add new to create a new SQL worksheet.

Run the following SQL, replacing <integration_name> with a name of your choice (e.g., STACKONE_OAUTH), <callback_url> with the Callback URL from your Connector Profile, and <role_name> with the Snowflake role your users will authorize with.

CREATE SECURITY INTEGRATION <integration_name>
  TYPE = OAUTH
  OAUTH_CLIENT = CUSTOM
  OAUTH_CLIENT_TYPE = 'CONFIDENTIAL'
  OAUTH_REDIRECT_URI = '<callback_url>'
  ENABLED = TRUE
  OAUTH_ISSUE_REFRESH_TOKENS = TRUE
  OAUTH_REFRESH_TOKEN_VALIDITY = 7776000
  PRE_AUTHORIZED_ROLES_LIST = ('<role_name>');

• OAUTH_REFRESH_TOKEN_VALIDITY is in seconds — 7776000 equals 90 days
• The role in PRE_AUTHORIZED_ROLES_LIST must exactly match the Snowflake Role field.
• Example: if your users connect with the SYSADMIN role, use PRE_AUTHORIZED_ROLES_LIST = ('SYSADMIN') and enter SYSADMIN as the Snowflake Role
• To find a role: your current role is shown next to your username in the bottom-left corner of Snowsight (e.g., ACCOUNTADMIN). Note that ACCOUNTADMIN, SECURITYADMIN, ORGADMIN, and GLOBALORGADMIN are blocked for OAuth — pick a non-blocked role such as SYSADMIN

Snowflake generates the client credentials when the integration is created, and they are retrieved with a system function rather than shown in the UI.

In the same worksheet, run the following SQL, replacing <INTEGRATION_NAME> with your integration name in uppercase, wrapped in single quotes.

SELECT SYSTEM$SHOW_OAUTH_CLIENT_SECRETS('<INTEGRATION_NAME>');

The result is a JSON object containing your client credentials. Copy them across.

• oauth_client_id is your OAuth Client ID
• oauth_client_secret is your OAuth Client Secret

Sign in to your Snowflake account and click your user profile (showing your username and role) in the bottom-left corner of the sidebar.

• In the menu that opens, click your account entry (e.g., Account: AB12345) to expand the account submenu.
• Select View account details.
• Copy the Account Identifier shown in the dialog.
• Format: orgname-accountname (e.g., myorg-account123)
• Alternative — run SELECT CURRENT_ORGANIZATION_NAME() || '-' || CURRENT_ACCOUNT_NAME(); in any worksheet