Connecting Snowflake to your app

Query data, run analytics, and manage data warehouses in Snowflake from your Base44 app.

Connect your Base44 app to Snowflake to query data, run analytics, and manage data warehouses, then build dashboards and reports on top of your warehouse data.

Snowflake is a connector for app builders. You connect it once with your own Snowflake credentials at the workspace level, and your app queries the warehouse through that connection. Each person using your app does not connect Snowflake themselves.

You need a Builder plan or higher to use connectors in your app.

---

What you can do

Query warehouse data

Run SQL against your Snowflake warehouse and surface the results in your app.

Build analytics dashboards

Turn warehouse queries into charts, tables, and dashboards your team can read.

Trigger on data changes

Combine Snowflake with other connectors, for example alert a Slack channel when a metric drops.

Example prompts for the AI chat

Query sales data from my Snowflake warehouse and display results.

Run an analytics report on customer data stored in Snowflake.

Fetch inventory levels from the Snowflake data warehouse.

Execute a SQL query to analyze trends in my Snowflake tables.

---

At a glance

Type identifier

snowflake

Auth model

OAuth, bring your own credentials

Connector type

For app builders (workspace-level)

Connection config

subdomain (your Snowflake account identifier, in the form orgname-account_name), required

---

Setting up OAuth in Snowflake

Snowflake has no central OAuth application. The OAuth client lives inside your own Snowflake account, so you create it there and then give Base44 its credentials. There is no way to do this in Snowsight, so run the statements below as ACCOUNTADMIN in a SQL worksheet.

When you authorize the connection later, sign in with a regular user that has a DEFAULT_ROLE and a DEFAULT_WAREHOUSE set. Snowflake blocks ACCOUNTADMIN, SECURITYADMIN, and ORGADMIN from authorizing external applications. This is a Snowflake security default, not a Base44 restriction.

To change an integration that already exists, use ALTER. CREATE OR REPLACE generates a new Client ID and Client Secret and invalidates the old ones.

To set up OAuth in Snowflake:

1. Create the OAuth security integration:

   USE ROLE ACCOUNTADMIN;
   
   CREATE SECURITY INTEGRATION BASE44_OAUTH
     TYPE                         = OAUTH
     OAUTH_CLIENT                 = CUSTOM
     OAUTH_CLIENT_TYPE            = 'CONFIDENTIAL'
     OAUTH_REDIRECT_URI           = 'https://connectors.base44.com/api/oauth/callback'
     OAUTH_ISSUE_REFRESH_TOKENS   = TRUE
     OAUTH_REFRESH_TOKEN_VALIDITY = 7776000
     ENABLED                      = TRUE;
   

   If the integration already exists and only the callback URL needs updating, run this instead, which keeps the existing Client ID and Client Secret:

   ALTER SECURITY INTEGRATION BASE44_OAUTH
     SET OAUTH_REDIRECT_URI = 'https://connectors.base44.com/api/oauth/callback';
   

2. Read your Client ID and Client Secret:

   SELECT
     PARSE_JSON(SYSTEM$SHOW_OAUTH_CLIENT_SECRETS('BASE44_OAUTH')):OAUTH_CLIENT_ID::STRING     AS client_id,
     PARSE_JSON(SYSTEM$SHOW_OAUTH_CLIENT_SECRETS('BASE44_OAUTH')):OAUTH_CLIENT_SECRET::STRING AS client_secret;
   

   Copy each value with the cell’s copy button rather than selecting it by hand. The Client ID often ends in =, and dropping that character breaks the connection. OAUTH_CLIENT_SECRET_2 also appears in the output as a spare for rotation, so use the first secret.

3. Get your account identifier:

   SELECT CURRENT_ORGANIZATION_NAME() || '-' || CURRENT_ACCOUNT_NAME() AS account_identifier;
   

4. Confirm the integration is ready:

   DESC SECURITY INTEGRATION BASE44_OAUTH;
   

   Check that ENABLED is true and that OAUTH_REDIRECT_URI matches the callback URL exactly.

---

Connecting Snowflake

Snowflake is a connector for app builders, so you connect it once at the workspace level with your own warehouse credentials.

Before you begin, you need:

• A Snowflake OAuth security integration in your Snowflake account, so you have a Client ID and Client Secret. See Setting up OAuth in Snowflake.
• Your Snowflake account identifier (the subdomain), in orgname-account_name format, for example nzajreo-sp04035. Not the legacy account locator.
• Credentials authorized to query the databases you want to use.

To add Snowflake from your workspace settings:

1. Click your workspace name at the bottom left.
2. Click Settings.
3. Click Connectors under Plugins.
4. Under Connectors For App Builders, find Snowflake.
5. Click Add next to the connector.
6. Confirm the callback URL https://connectors.base44.com/api/oauth/callback is set on your Snowflake OAuth integration.
7. Enter a Connector name to identify this connector.
8. Enter the Client ID and Client Secret, then clear Additional scopes if anything is already in it.
9. Enter your Snowflake Account identifier, in orgname-account_name format.
10. Click Add Connector.

You can also set up Snowflake from the AI chat in an app. Describe what you want to build, and when prompted, provide the same connector details. The connector is registered at the workspace level and becomes available across all apps in that workspace.

---

Scopes

You do not choose Snowflake scopes in Base44. Snowflake does not expose selectable scopes. A Snowflake admin sets access inside Snowflake, according to user roles.

Additional scopes must be empty when you register the connector. The field often arrives already filled in, so clear it before you save. Snowflake rejects values such as account:read and session:role:select with The requested scope is invalid.

With the field empty, Snowflake applies the default role for the account that connects, and Base44 adds the refresh_token scope automatically, listed under Always included.

---

Using Snowflake in a backend function

Once Snowflake is connected, your backend functions can retrieve an access token and query your warehouse. Base44 handles the OAuth flow and credential storage.

const connection = await base44.asServiceRole.connectors.getConnection("snowflake");
// Use the connection's access token to call the Snowflake SQL API.

For the full pattern, including how to read the connection details and structure the request, see the developer documentation:

Connectors (developer docs)

Retrieve a connection, read its details, and call the service API from a backend function.

---

Troubleshooting

I do not see Snowflake in workspace settings

Confirm that you are working in the correct workspace and that you have permission to manage workspace connectors. If you still do not see Snowflake, contact support.

My Snowflake Account is not accepted

Enter your account identifier in orgname-account_name format, for example nzajreo-sp04035. Do not include .snowflakecomputing.com.

The legacy account locator format, such as xy12345.us-east-1, is not supported for OAuth. Using it fails with OAuth client integration with the given client id is not found. The message names the Client ID, but the account field is the actual cause.

To find your identifier, run this in a Snowflake worksheet:

SELECT CURRENT_ORGANIZATION_NAME() || '-' || CURRENT_ACCOUNT_NAME() AS account_identifier;

You can also read it off your Snowsight URL: app.snowflake.com/<org>/<account> becomes <org>-<account>.

The connection does not work after setup

Check that the callback URL https://connectors.base44.com/api/oauth/callback is added to your Snowflake OAuth integration. Then confirm that the Client ID, Client Secret, and Snowflake Account are correct, and that the Snowflake role has access to the databases you are querying.

The connection fails with a redirect URI mismatch

The callback URL registered in Snowflake does not match the one Base44 sends. Run DESC SECURITY INTEGRATION BASE44_OAUTH; and confirm that OAUTH_REDIRECT_URI is exactly https://connectors.base44.com/api/oauth/callback. Snowflake allows one redirect URI per integration and matches it character for character.

The connection fails because your role is blocked

You signed in with an admin user. Snowflake blocks ACCOUNTADMIN, SECURITYADMIN, and ORGADMIN from authorizing external applications by default. Sign in with a regular user instead.

---

FAQs

Common questions about connecting Snowflake to your app.

Who can add the Snowflake connector?

You need permission to manage workspace connectors.

Where do I find the Base44 redirect URI?

Snowflake uses one callback URL for every app in your workspace: https://connectors.base44.com/api/oauth/callback. Add it to your Snowflake OAuth integration. If you are setting the connector up from the AI chat, the setup form also shows it.

Connectors you added before Base44 moved to a single callback URL still use https://app.base44.com/api/external-auth/callback. Keep that URL registered in Snowflake for as long as the connector uses per-app URLs.

What should I enter for Snowflake Account?

Enter your account identifier in orgname-account_name format, for example nzajreo-sp04035. Do not include .snowflakecomputing.com, and do not use the legacy account locator format such as xy12345.us-east-1, which is not supported for OAuth.

Can I add Snowflake from the AI chat?

Yes. You can start from the AI chat in a specific app. If the connector is not set up yet, Base44 asks for the connector details before continuing.

Do people using my app need to connect Snowflake themselves?

No. The Snowflake connector is set up once at the workspace level and can be used across apps in that workspace.