Connect Snowflake with OAuth 2.0 (Account-level) – StackOne Hub

Sign in to your Snowflake account.

• In the left sidebar, go to Projects > Workspaces.
• Click + Add new to create a new SQL worksheet.

Run the following SQL, replacing <integration_name> with a name of your choice (e.g., STACKONE_OAUTH) and <role_name> with the Snowflake role your users will authorize with.

CREATE SECURITY INTEGRATION <integration_name>
  TYPE = OAUTH
  OAUTH_CLIENT = CUSTOM
  OAUTH_CLIENT_TYPE = 'CONFIDENTIAL'
  OAUTH_REDIRECT_URI = 'https://api.stackone.com/connect/oauth2/snowflake/callback'
  ENABLED = TRUE
  OAUTH_ISSUE_REFRESH_TOKENS = TRUE
  OAUTH_REFRESH_TOKEN_VALIDITY = 7776000
  PRE_AUTHORIZED_ROLES_LIST = ('<role_name>');

• OAUTH_REFRESH_TOKEN_VALIDITY is in seconds — 7776000 equals 90 days
• The role in PRE_AUTHORIZED_ROLES_LIST must exactly match the Snowflake Role field.
• Example: if your users connect with the SYSADMIN role, use PRE_AUTHORIZED_ROLES_LIST = ('SYSADMIN') and enter SYSADMIN as the Snowflake Role
• To find a role: your current role is shown next to your username in the bottom-left corner of Snowsight (e.g., ACCOUNTADMIN). Note that ACCOUNTADMIN, SECURITYADMIN, ORGADMIN, and GLOBALORGADMIN are blocked for OAuth — pick a non-blocked role such as SYSADMIN

In the same worksheet, run the following SQL, replacing <INTEGRATION_NAME> with your integration name in uppercase, wrapped in single quotes.

SELECT SYSTEM$SHOW_OAUTH_CLIENT_SECRETS('<INTEGRATION_NAME>');

The result is a JSON object containing your client credentials. Store them securely for use later.

• oauth_client_id is your OAuth Client ID
• oauth_client_secret is your OAuth Client Secret

Sign in to your Snowflake account and click your user profile (showing your username and role) in the bottom-left corner of the sidebar.

• In the menu that opens, click your account entry (e.g., Account: AB12345) to expand the account submenu.
• Select View account details.
• Copy the Account Identifier shown in the dialog.
• Format: orgname-accountname (e.g., myorg-account123)
• Alternative — run SELECT CURRENT_ORGANIZATION_NAME() || '-' || CURRENT_ACCOUNT_NAME(); in any worksheet