Snowflake OAuth configuration

This guide walks you through setting up Snowflake OAuth authentication for Gumloop. By following these steps, you’ll configure a secure OAuth integration that allows Gumloop to connect to your Snowflake account on behalf of your users.

Intended Audience: Snowflake administrators with ACCOUNTADMIN role or users with CREATE INTEGRATION privilege. You perform this setup once, and it enables OAuth authentication for your organization’s Snowflake connection.

Alternative Authentication: If setting up OAuth isn’t feasible for your organization, you can use Snowflake Key-Pair (RSA JWT), which is best for service users and MFA-enforced accounts, or Snowflake PAT (Programmatic Access Token). OAuth remains the recommended approach for interactive users thanks to enhanced security and automatic token refresh.

This guide provides basic setup instructions for integrating Snowflake with Gumloop. For production environments and security best practices, please refer to the official Snowflake OAuth documentation to ensure your configuration meets your organization’s security requirements.

What this guide covers

This guide helps you:

Create a Snowflake OAuth Integration - Register Gumloop as a custom OAuth client in Snowflake
Retrieve OAuth Credentials - Get the Client ID and Client Secret needed for Gumloop
Configure Gumloop (Administrator) - Add the Snowflake OAuth Config to your organization
User Authentication - Connect individual user accounts with proper scopes

Once complete, your team can authenticate Snowflake connections through OAuth in Gumloop.

Overview

Snowflake OAuth integration enables secure authentication between Gumloop and your Snowflake account. Instead of sharing static credentials, OAuth allows users to authorize Gumloop to access Snowflake on their behalf with automatic token refresh and better security controls.

Why use Snowflake OAuth with Gumloop?

Enhanced security

OAuth tokens are temporary and can be revoked, reducing the risk of credential exposure

Automatic token refresh

Refresh tokens keep your connection active without manual re-authentication

Centralized control

Manage access and permissions directly in Snowflake

Audit trail

Track OAuth authentication events in Snowflake’s audit logs

Prerequisites

Before you begin, ensure you have:

Snowflake Account Access - You need the ACCOUNTADMIN role or a role with CREATE INTEGRATION privilege
Snowflake Account URL - Your Snowflake account URL (for example, https://myorg-account123.snowflakecomputing.com)

Step 1: Create the Snowflake OAuth integration

You’ll run SQL commands in Snowflake to create a custom OAuth integration for Gumloop.

1.1 Connect to Snowflake

Log in to your Snowflake account
Open a new SQL worksheet
Ensure you’re using a role with sufficient privileges:

USE ROLE ACCOUNTADMIN;

If you don’t have the ACCOUNTADMIN role, ask your Snowflake administrator to either grant you this role temporarily or execute these commands on your behalf.

1.2 Create the OAuth integration

Copy and execute the following SQL command to create the OAuth integration:

CREATE OR REPLACE SECURITY INTEGRATION GUMLOOP
  TYPE = OAUTH
  ENABLED = TRUE
  OAUTH_CLIENT = CUSTOM
  OAUTH_CLIENT_TYPE = 'CONFIDENTIAL'
  OAUTH_REDIRECT_URI = 'https://api.gumloop.com/auth/callback'
  OAUTH_ISSUE_REFRESH_TOKENS = TRUE
  OAUTH_REFRESH_TOKEN_VALIDITY = 7776000;

Understanding the configuration parameters

TYPE = OAUTH - Specifies this is an OAuth integration
ENABLED = TRUE - Activates the integration immediately
OAUTH_CLIENT = CUSTOM - Indicates this is a custom OAuth client (not a pre-built partner integration)
OAUTH_CLIENT_TYPE = 'CONFIDENTIAL' - Marks this as a confidential client that can securely store secrets
OAUTH_REDIRECT_URI - The Gumloop callback URL that Snowflake sends users to after authentication
OAUTH_ISSUE_REFRESH_TOKENS = TRUE - Enables automatic token refresh for persistent connections
OAUTH_REFRESH_TOKEN_VALIDITY = 7776000 - Sets refresh token validity to 90 days (7,776,000 seconds)

Important: Snowflake automatically adds certain administrative roles to the OAuth blocked roles list: ACCOUNTADMIN, ORGADMIN, SECURITYADMIN, and GLOBALORGADMIN. If you need to use these roles with OAuth, you must either:

Remove them from the blocked roles list, if your organization’s security policy allows, or
Switch to a different role that isn’t blocked

For more information, see the Blocking Specific Roles section below.

For custom OAuth integrations (OAUTH_CLIENT = CUSTOM), you don’t configure scopes on the security integration itself. Instead, the OAuth authorization request specifies them. Gumloop handles this automatically when users connect their accounts.To control which roles users can choose with this integration, use BLOCKED_ROLES_LIST to deny specific roles or PRE_AUTHORIZED_ROLES_LIST to skip the user consent step for specific roles. Refer to the Snowflake OAuth documentation for details.

1.3 Verify the integration

Confirm that Snowflake created the integration:

SHOW SECURITY INTEGRATIONS LIKE 'GUMLOOP';

You should see GUMLOOP in the results.

1.4 View integration details

To see all configuration details:

DESC SECURITY INTEGRATION GUMLOOP;

This displays all properties of your OAuth integration, including the OAuth endpoints.

Step 2: Retrieve OAuth credentials

Now you need to get the Client ID and Client Secret that Gumloop uses to authenticate.

2.1 Get client credentials

Execute the following command:

SELECT SYSTEM$SHOW_OAUTH_CLIENT_SECRETS('GUMLOOP');

This returns a JSON object containing your credentials. The output looks like this:

{
  "OAUTH_CLIENT_ID": "ABC123XYZ456...",
  "OAUTH_CLIENT_SECRET": "def789ghi012...",
  "OAUTH_CLIENT_SECRET_2": ""
}

Keep these credentials secure! Treat the Client ID and Client Secret like passwords. Don’t share them publicly or commit them to version control.

2.2 Save the credentials

Copy and save the following values from the JSON response:

OAUTH_CLIENT_ID - You’ll need this for Gumloop
OAUTH_CLIENT_SECRET - You’ll need this for Gumloop

Store these credentials in a secure password manager until you’re ready to add them to Gumloop.

Step 3: Configure Gumloop (administrator setup)

Now that you have your Snowflake OAuth credentials, you’ll add them to Gumloop as an administrator.

3.1 Add Snowflake OAuth config to Gumloop

Navigate to Settings → Organization → OAuth Configuration
Find Snowflake OAuth Config in the Available list
Click Add

OAuth Configuration page with Snowflake OAuth Config highlighted in the Available list

Enter the following information:
- Client ID: The OAUTH_CLIENT_ID from Step 2.1
- Client Secret: The OAUTH_CLIENT_SECRET from Step 2.1

Save the configuration

This sets up the OAuth integration at the organization level. Individual users can now connect using this configuration.

Step 4: User authentication

Once the Gumloop administrator has completed Step 3, individual users can connect their Snowflake accounts.

4.1 Connect your Snowflake account

Navigate to Connectors page
Search for Snowflake and click Add
Choose the first Snowflake option as the authentication method

Personal Connectors page with Snowflake in the search results and an Add button

Select Snowflake OAuth Config, the configuration your administrator added, or Okta if that’s set up
Enter the following information:
- Workspace ID: Your Snowflake account identifier (for example, myorg-account123)
- Scopes: Space-separated list of OAuth scopes (see warning below)

PrivateLink and Private Service Connect

PrivateLink accounts aren’t supported with Gumloop’s standard (cloud-hosted) deployment unless you whitelist Gumloop’s static egress IPs in your Snowflake network policy. The OAuth handshake requires Gumloop to reach your Snowflake account over the public internet. If your Snowflake account is behind AWS PrivateLink, Azure Private Link, or Google Cloud Private Service Connect and you can’t whitelist Gumloop’s IPs, connections fail because Gumloop’s servers can’t reach the private endpoint.The solution is a VPC deployment, where Gumloop runs inside your network perimeter so the OAuth handshake stays private. Contact support@gumloop.com to explore VPC deployment options for your organization.

If your Snowflake account uses PrivateLink and you have a Gumloop VPC deployment, include .privatelink in the Workspace ID. For example, if your Snowflake URL is https://myorg-account123.privatelink.snowflakecomputing.com, enter myorg-account123.privatelink. Snowflake admins can find the private account URL by running SYSTEM$GET_PRIVATELINK_CONFIG() and checking the regionless-privatelink-account-url field. Use privatelink-account-url instead for the region-specific locator format.

Critical: Scopes ConfigurationIf you leave scopes empty, most Snowflake operations fail. You must specify the roles you want to use with this connection.Required format:

session:role:YOUR_ROLE_NAME

Replace YOUR_ROLE_NAME with your actual Snowflake role, for example PUBLIC or ANALYST. The role name is case-sensitive and must be in uppercase unless you created the role with quotes.

Note: Gumloop automatically handles the refresh_token scope internally. You only need to specify the role scopes.

Examples:

Basic access: session:role:PUBLIC
Analyst role: session:role:ANALYST
Custom role: session:role:DATA_ENGINEER
Multiple roles: session:role:ANALYST,session:role:DATA_ENGINEER

For detailed scope configuration, refer to the Snowflake OAuth scope documentation.

4.2 Authorize the connection

After entering your information:

Click Connect or Authorize
Snowflake’s authorization page opens
Log in with your Snowflake credentials
Review the requested permissions and role
Click Authorize to grant Gumloop access
Snowflake sends you back to Gumloop with a successful connection

4.3 Verify your connection

To confirm your OAuth connection is working correctly:

Go to Connectors page
Search for Snowflake
If the connection is successful, you should see your Snowflake username displayed instead of “Snowflake Account”

Snowflake OAuth verification showing username instead of account name

If you see your username listed, as shown in the image above, your OAuth connection is properly configured and ready to use!

Blocking specific roles

For security reasons, Snowflake automatically blocks certain administrative roles from OAuth. These blocked roles include:

ACCOUNTADMIN
ORGADMIN
SECURITYADMIN
GLOBALORGADMIN

Snowflake blocks these roles by default. To remove them from the block list, you must contact Snowflake Support and obtain approval from your security team.

Adding additional blocked roles

To block additional custom roles from OAuth:

ALTER SECURITY INTEGRATION GUMLOOP 
  SET BLOCKED_ROLES_LIST = ('SYSADMIN', 'CUSTOM_ADMIN_ROLE');

If users need to access Snowflake with OAuth using a blocked role, they have two options:

Request removal from the blocked roles list (requires Snowflake Support approval)
Switch to a different, non-blocked role that has the necessary permissions

Troubleshooting

”Invalid client” error

Problem: Getting an “invalid_client” error when connecting Solution:

Verify the Client ID and Client Secret are correct in the Snowflake OAuth Config
Check the integration’s ENABLED property: DESC SECURITY INTEGRATION GUMLOOP;
Ensure the redirect URI matches exactly: https://api.gumloop.com/auth/callback

Most operations are failing

Problem: Connected successfully but Snowflake operations return permission errors Solution: This usually means the scope configuration is incorrect. Ensure you specified a valid role scope when connecting your Snowflake account. Update your credential with a proper role scope, for example: session:role:PUBLIC Gumloop automatically handles the refresh_token scope, so you only need to specify the role.

Role access issues

Problem: Users can’t access certain Snowflake resources or specific role Solution:

Verify you spelled the role name in your scope correctly and in uppercase
Check whether the desired role appears in the blocked roles list: DESC SECURITY INTEGRATION GUMLOOP;
Ensure the user has the role in Snowflake: SHOW GRANTS TO USER your_username;
Administrative roles such as ACCOUNTADMIN and SECURITYADMIN are on the blocked list by default

Username not showing in Gumloop

Problem: Still seeing “Snowflake Account” instead of username in credentials page Solution:

The OAuth authorization may not have completed successfully
Try removing the credential and re-connecting
Verify your scopes include a valid role, for example session:role:PUBLIC
Check Snowflake audit logs to confirm the OAuth authorization was successful

Tokens expiring too quickly

Problem: Users need to re-authenticate frequently Solution: Increase the refresh token validity in Snowflake:

ALTER SECURITY INTEGRATION GUMLOOP 
  SET OAUTH_REFRESH_TOKEN_VALIDITY = 15552000;  -- 180 days

Security best practices

Regular credential rotation

Periodically rotate your OAuth client secrets to maintain security

Principle of least privilege

Grant users only the minimum Snowflake roles needed for their work

Monitor OAuth activity

Regularly review OAuth token usage in Snowflake audit logs

Network policies

Configure Snowflake network policies to restrict OAuth access by IP

For comprehensive security guidance and advanced configuration options, refer to the official Snowflake OAuth documentation.

Additional resources

Need help?

If you encounter issues not covered in this guide:

Check the Snowflake OAuth documentation for detailed technical information
Contact your Snowflake administrator for account-specific issues
Reach out to us for integration assistance

​What this guide covers

​Overview

​Why use Snowflake OAuth with Gumloop?

Enhanced security

Automatic token refresh

Centralized control

Audit trail

​Prerequisites

​Step 1: Create the Snowflake OAuth integration

​1.1 Connect to Snowflake

​1.2 Create the OAuth integration

​1.3 Verify the integration

​1.4 View integration details

​Step 2: Retrieve OAuth credentials

​2.1 Get client credentials

​2.2 Save the credentials

​Step 3: Configure Gumloop (administrator setup)

​3.1 Add Snowflake OAuth config to Gumloop

​Step 4: User authentication

​4.1 Connect your Snowflake account

​PrivateLink and Private Service Connect

​4.2 Authorize the connection

​4.3 Verify your connection

​Blocking specific roles

​Adding additional blocked roles

​Troubleshooting

​”Invalid client” error

​Most operations are failing

​Role access issues

​Username not showing in Gumloop

​Tokens expiring too quickly

​Security best practices

Regular credential rotation

Principle of least privilege

Monitor OAuth activity

Network policies

​Additional resources

​Need help?

What this guide covers

Overview

Why use Snowflake OAuth with Gumloop?

Prerequisites

Step 1: Create the Snowflake OAuth integration

1.1 Connect to Snowflake

1.2 Create the OAuth integration

1.3 Verify the integration

1.4 View integration details

Step 2: Retrieve OAuth credentials

2.1 Get client credentials

2.2 Save the credentials

Step 3: Configure Gumloop (administrator setup)

3.1 Add Snowflake OAuth config to Gumloop

Step 4: User authentication

4.1 Connect your Snowflake account

PrivateLink and Private Service Connect

4.2 Authorize the connection

4.3 Verify your connection

Blocking specific roles

Adding additional blocked roles

Troubleshooting

”Invalid client” error

Most operations are failing

Role access issues

Username not showing in Gumloop

Tokens expiring too quickly

Security best practices

Additional resources

Need help?