> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stackone.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect Snowflake with OAuth 2.0 (Account-level) – StackOne Hub

> Link a Snowflake account in the StackOne Hub using OAuth 2.0 (Account-level). End-user guide to authorize the integration and start using Snowflake actions.

<Warning>ACCOUNTADMIN role (or a role with the global CREATE INTEGRATION privilege) is required to create the OAuth security integration. Note: ACCOUNTADMIN, SECURITYADMIN, ORGADMIN, and GLOBALORGADMIN are blocked from OAuth by default and cannot be used as the Snowflake Role.</Warning>

<section data-guide-section data-guide-scopes="">
  <h2>Create an OAuth security integration</h2>

  <p>A custom OAuth security integration registers StackOne as an OAuth client in your Snowflake account and pre-authorizes the role your users will connect with.</p>

  <Steps>
    <Step title="Sign in to Snowflake">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>Sign in to your <a href="https://app.snowflake.com" target="_blank" rel="noopener noreferrer">Snowflake account</a>.</p>

        <ul>
          <li>In the left sidebar, go to <strong>Projects</strong> > <strong>Workspaces</strong>.</li>
          <li>Click <strong>+ Add new</strong> to create a new SQL worksheet.</li>
        </ul>
      </div>
    </Step>

    <Step title="Create the security integration">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>Run the following SQL, replacing `<integration_name>` with a name of your choice (e.g., `STACKONE_OAUTH`) and `<role_name>` with the Snowflake role your users will authorize with.</p>

        ```sql theme={null}
        CREATE SECURITY INTEGRATION <integration_name>
          TYPE = OAUTH
          OAUTH_CLIENT = CUSTOM
          OAUTH_CLIENT_TYPE = 'CONFIDENTIAL'
          OAUTH_REDIRECT_URI = 'https://api.stackone.com/connect/oauth2/snowflake/callback'
          ENABLED = TRUE
          OAUTH_ISSUE_REFRESH_TOKENS = TRUE
          OAUTH_REFRESH_TOKEN_VALIDITY = 7776000
          PRE_AUTHORIZED_ROLES_LIST = ('<role_name>');
        ```

        <ul>
          <li>`OAUTH_REFRESH_TOKEN_VALIDITY` is in seconds — 7776000 equals 90 days</li>
          <li>The role in `PRE_AUTHORIZED_ROLES_LIST` must exactly match the <strong>Snowflake Role</strong> field.</li>
          <li>Example: if your users connect with the `SYSADMIN` role, use `PRE_AUTHORIZED_ROLES_LIST = ('SYSADMIN')` and enter `SYSADMIN` as the <strong>Snowflake Role</strong></li>
          <li>To find a role: your current role is shown next to your username in the bottom-left corner of Snowsight (e.g., `ACCOUNTADMIN`). Note that ACCOUNTADMIN, SECURITYADMIN, ORGADMIN, and GLOBALORGADMIN are blocked for OAuth — pick a non-blocked role such as `SYSADMIN`</li>
        </ul>
      </div>
    </Step>
  </Steps>
</section>

<section data-guide-section data-guide-scopes="">
  <h2>Retrieve your OAuth client credentials</h2>

  <p>Snowflake generates the client credentials when the integration is created; they are retrieved with a system function rather than shown in the UI.</p>

  <Steps>
    <Step title="Fetch the client credentials">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>In the same worksheet, run the following SQL, replacing `<INTEGRATION_NAME>` with your integration name in uppercase, wrapped in single quotes.</p>

        ```sql theme={null}
        SELECT SYSTEM$SHOW_OAUTH_CLIENT_SECRETS('<INTEGRATION_NAME>');
        ```
      </div>
    </Step>

    <Step title="Copy your credentials">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>The result is a JSON object containing your client credentials. Store them securely for use later.</p>

        <ul>
          <li>`oauth_client_id` is your <strong>OAuth Client ID</strong></li>
          <li>`oauth_client_secret` is your <strong>OAuth Client Secret</strong></li>
        </ul>
      </div>
    </Step>
  </Steps>
</section>

<section data-guide-section data-guide-scopes="">
  <h2>Find your account identifier</h2>

  <p>Your account identifier uniquely identifies your Snowflake account and routes API requests to it.</p>

  <Steps>
    <Step title="Open account details in Snowsight">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>Sign in to your <a href="https://app.snowflake.com" target="_blank" rel="noopener noreferrer">Snowflake account</a> and click your <strong>user profile</strong> (showing your username and role) in the bottom-left corner of the sidebar.</p>

        <ul>
          <li>In the menu that opens, click your account entry (e.g., <strong>Account: AB12345</strong>) to expand the account submenu.</li>
          <li>Select <strong>View account details</strong>.</li>
          <li>Copy the <strong>Account Identifier</strong> shown in the dialog.</li>
          <li>Format: `orgname-accountname` (e.g., `myorg-account123`)</li>
          <li>Alternative — run `SELECT CURRENT_ORGANIZATION_NAME() || '-' || CURRENT_ACCOUNT_NAME();` in any worksheet</li>
        </ul>
      </div>
    </Step>
  </Steps>
</section>

<div data-whitelabel-hide>
  <h2>Linking the Account from the Hub</h2>

  <Steps>
    <Step title="Navigate to the Hub">
      Use one of the three <a href="/connect/managing-connectors/linking-accounts">Linking Account Methods</a> to access the Hub.
    </Step>

    <Step title="Fill out the fields">
      Fill out the following fields using details from your provider:

      <ul>
        <li><strong>Account Identifier</strong></li>
        <li><strong>OAuth Client ID</strong></li>
        <li><strong>OAuth Client Secret</strong></li>
        <li><strong>Snowflake Role</strong></li>
      </ul>
    </Step>

    <Step title="Connect">
      <ul>
        <li>Click <strong>Connect</strong></li>
        <li>If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider's authorization flow.</li>
        <li>Once authorization is successful, you will see a confirmation popup</li>
      </ul>
    </Step>
  </Steps>

  <p>If the account linking is successful, you will see the newly linked account in your <a href="/gateway/concepts/linked-accounts">Accounts</a> page.</p>
</div>