Connecting Snowflake to your app

Connect Snowflake to your app to query warehouse data.

Connect your app to Snowflake to query warehouse data, run analytics, and use the results in dashboards, reports, and workflows.

You need a Builder plan or higher to use connectors in your app.

---

What you can do

Use your warehouse data to answer questions and keep your team informed.

Query warehouse data

Run SQL against your Snowflake warehouse and show the results in your app.

Build analytics dashboards

Display warehouse results in charts, tables, and dashboards.

Automate data workflows

Use Snowflake queries in workflows, such as sending an alert to a Slack channel when a metric drops.

Example prompts

Describe the data you want, what triggers the query, and any dynamic fields in the AI chat. For example:

Query sales data from my Snowflake warehouse and display results.

Run an analytics report on customer data stored in Snowflake.

Fetch inventory levels from the Snowflake data warehouse.

Execute a SQL query to analyze trends in my Snowflake tables.

Show me which databases and tables I have in Snowflake.

---

Setting up OAuth in Snowflake

Snowflake OAuth uses a security integration. Create it in Snowflake before you register the connector in Base44.

1. Get the Base44 callback URL

   Get the Base44 callback URL from Registering callback URLs. The SQL below registers it as OAUTH_REDIRECT_URI.

2. Create the OAuth security integration

   Use ACCOUNTADMIN or a role with the global CREATE INTEGRATION privilege. This example uses ACCOUNTADMIN. If you use another role, replace the first statement.

   USE ROLE ACCOUNTADMIN;
   
   CREATE SECURITY INTEGRATION BASE44_OAUTH
     TYPE                         = OAUTH
     OAUTH_CLIENT                 = CUSTOM
     OAUTH_CLIENT_TYPE            = 'CONFIDENTIAL'
     OAUTH_REDIRECT_URI           = 'https://connectors.base44.com/api/oauth/callback'
     OAUTH_ISSUE_REFRESH_TOKENS   = TRUE
     OAUTH_REFRESH_TOKEN_VALIDITY = 7776000
     ENABLED                      = TRUE;
   

   This sets refresh tokens to 90 days, Snowflake’s default and maximum value.

   If View redirect URIs lists additional URLs for existing connections, add every one to OAUTH_ALTERNATE_REDIRECT_URIS in this CREATE SECURITY INTEGRATION statement.

   If you choose another integration name, use it in the remaining SQL statements.

3. Get your connection details

   Read your Client ID and Client Secret.

   SELECT
     PARSE_JSON(SYSTEM$SHOW_OAUTH_CLIENT_SECRETS('BASE44_OAUTH')):OAUTH_CLIENT_ID::STRING     AS client_id,
     PARSE_JSON(SYSTEM$SHOW_OAUTH_CLIENT_SECRETS('BASE44_OAUTH')):OAUTH_CLIENT_SECRET::STRING AS client_secret;
   

   Use the cell’s copy button for both values. The Client ID often ends in =, and omitting that character breaks the connection.

   Get the Snowflake account identifier you’ll enter in Base44.

   SELECT CURRENT_ORGANIZATION_NAME() || '-' || CURRENT_ACCOUNT_NAME() AS account_identifier;
   
4. Prepare the Snowflake identity

   Use a regular Snowflake identity with a DEFAULT_ROLE and DEFAULT_WAREHOUSE set. Its role needs access to the databases and objects your app queries and permission to use the warehouse.

   Snowflake blocks ACCOUNTADMIN, SECURITYADMIN, ORGADMIN, and GLOBALORGADMIN from using this integration by default. This is a Snowflake security default, not a Base44 restriction.

Already have an OAuth integration?

Use ALTER to change an existing integration. CREATE OR REPLACE deletes and recreates it, so don’t use it for a redirect URI change.

If the integration already exists and only the callback URL needs updating, run this instead.

ALTER SECURITY INTEGRATION BASE44_OAUTH
  SET OAUTH_REDIRECT_URI = 'https://connectors.base44.com/api/oauth/callback';

If View redirect URIs shows URLs for existing connections, include all additional URLs in OAUTH_ALTERNATE_REDIRECT_URIS. Keep any alternate URLs that are already registered.

ALTER SECURITY INTEGRATION BASE44_OAUTH
  SET OAUTH_ALTERNATE_REDIRECT_URIS = ('<additional callback URL>');

---

Connecting Snowflake

Connect Snowflake so your app can query your warehouse.

Before you begin:

• Snowflake OAuth integration: Create a Snowflake OAuth security integration so you have a Client ID and Client Secret. See Setting up OAuth in Snowflake.
• Snowflake account identifier: In the Snowflake web UI, click your account name in the bottom left, select Copy account URL, and use the part before .snowflakecomputing.com. You can also get the identifier with the SQL in Setting up OAuth in Snowflake.
• Base44 workspace access: You must be a workspace owner or admin to register the connector in Base44.
• Snowflake access: Each person who connects needs access to the databases you want to query.

To add Snowflake from the Connectors page:

1. Click Connectors in your workspace sidebar.
2. Click Add connector.
3. Search for Snowflake and click it.
4. Enter a Connector name.
5. Enter the Client ID and Client Secret from your Snowflake OAuth integration.
6. Keep refresh token under Scopes and leave Additional scopes empty. See Scopes and permissions.
7. Enter your Snowflake Account identifier under Connection Configuration in orgname-account_name format, for example nzajreo-sp04035. Don’t include .snowflakecomputing.com or use the legacy account locator.
8. Click Add Connector.
9. Open your app in the app editor.
10. Ask the AI chat to add a Snowflake feature.
11. Authorize the account when prompted.

Your app can use one shared Snowflake connection or let each person connect their own account. Tell the AI chat which you want.

---

Scopes and permissions

Your Snowflake permissions determine which warehouse data your app can query.

1. Base44 adds

   • refresh_token: Refreshes the connection without another sign-in
2. You configure

   • Leave Additional scopes empty. Snowflake rejects unsupported values, such as account:read, with The requested scope is invalid.
   • Don’t add session:role:<role>.

Access: Snowflake uses the default role and permissions of the identity that authorizes the connection.

---

Using Snowflake in a backend function

Once Snowflake is connected, your backend functions can retrieve an access token and query your warehouse. Base44 handles the OAuth flow and credential storage.

Shared connector

Use getWorkspaceConnection(connectorId) when your app uses one shared Snowflake identity.

import { createClientFromRequest } from "npm:@base44/sdk@0.8.44";

Deno.serve(async (req) => {
  const base44 = createClientFromRequest(req);
  const connectorId = "YOUR_CONNECTOR_ID";

  const { accessToken, connectionConfig } =
    await base44.asServiceRole.connectors.getWorkspaceConnection(connectorId);

  // Use accessToken to query Snowflake.
  return Response.json({ account: connectionConfig.subdomain });
});

App user connector

Use getCurrentAppUserConnection(connectorId) when each person connects with their own Snowflake identity.

import { createClientFromRequest } from "npm:@base44/sdk@0.8.44";

Deno.serve(async (req) => {
  const base44 = createClientFromRequest(req);
  const user = await base44.auth.me();

  if (!user) {
    return Response.json({ error: "Unauthorized" }, { status: 401 });
  }

  const connectorId = "YOUR_CONNECTOR_ID";
  const { accessToken, connectionConfig } =
    await base44.asServiceRole.connectors.getCurrentAppUserConnection(connectorId);

  // Use accessToken to query Snowflake for the signed-in person.
  return Response.json({ account: connectionConfig.subdomain });
});

Connectors (developer docs)

Retrieve a connection, read its details, and call the service API from a backend function.

---

Troubleshooting

Check roles, warehouse access, and callback URLs if Snowflake can’t connect or run queries.

Queries fail with a warehouse or access error

Check the connected Snowflake identity’s DEFAULT_ROLE and DEFAULT_WAREHOUSE. The role needs USAGE on the warehouse, database, and schema, plus SELECT on the tables or views your app queries. For an app user connection, check each person’s Snowflake role and grants.

The connection fails with a redirect URI mismatch

For the general fix, see redirect URI errors. In Snowflake, check that the integration is enabled and compare its registered redirect URIs with the URLs your connection uses.

DESC SECURITY INTEGRATION BASE44_OAUTH;

Confirm that every URI Base44 shows is registered as OAUTH_REDIRECT_URI or in OAUTH_ALTERNATE_REDIRECT_URIS. Snowflake matches redirect URIs character for character.

The connection fails because your role is blocked

You signed in with a privileged role. Snowflake blocks ACCOUNTADMIN, SECURITYADMIN, ORGADMIN, and GLOBALORGADMIN from using the integration by default. Sign in with a regular Snowflake user instead.