--- title: "How to Connect a Snowflake Database to Preset" slug: "snowflake" description: "Article about how to connect a Snowflake database to Preset Cloud." updated: 2026-10-29T14:14:11Z published: 2026-10-29T14:14:11Z canonical: "docs.preset.io/snowflake" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.preset.io/llms.txt > Use this file to discover all available pages before exploring further. # Snowflake ## Overview In this article we will discuss how to connect a Snowflake database to Preset. So let's get started! --- ## Allowlist Preset IPs Before starting, validate your [Snowflake Network Policies configuration](https://docs.snowflake.com/en/user-guide/network-policies), to ensure that Preset IP addresses are allowed to access Snowflake. The following IPs should be allowed (according to the workspace region): | us-west-2 (us1a) | us-east-1 (us2a) | eu-north-1 (eu5a) | ap-northeast-1 (ap1a) | | --- | --- | --- | --- | | 35.161.45.11 | 44.193.153.196 | 13.48.95.3 | 35.74.159.67 | | 54.244.23.85 | 52.70.123.52 | 13.51.212.165 | 35.75.171.157 | | 52.32.136.34 | 54.83.88.93 | 16.170.49.24 | 52.193.196.211 | If you are not sure where your Preset workspace is located, you can refer to the URL on your browser when accessing Preset. It should look like this: `https://xxxxxxxx.us2a.app.preset.io/superset...`, where `us2a` means it is in `us-east-1`. --- ## Connect Database to Preset Let's start by selecting **+ Database** — have a look at [Connecting your Data](/v1/docs/connecting-your-data) if you need help with this step. Select **Snowflake**. ![Snowflake_test_image.png](https://cdn.document360.io/4749ddf8-aa05-4f3f-80e1-07a5d2d0f137/Images/Documentation/image%28279%29.png) The *Connect a database* panel appears. There are three supported authentication methods to connect to Snowflake: - [Connect using username and password](/v1/docs/snowflake#connect-using-username-and-password) - [Connect using an encrypted key pair](/v1/docs/snowflake#connect-using-an-encrypted-key-pair) - [Connect using OAuth](/v1/docs/snowflake#connect-using-oauth) --- ## Connect using username and password Check Snowflake User Used When a new user is created on Snowflake, a password reset might be required on the initial login or use. Make sure the account that will be used to create the connection has a definitive password (it is not pending a password update). Fill the form with information from Snowflake: - **Database Name** with name of the database that you are connecting to - **Username** and **Password** with the credentials for the user - **Display Name** with the name to be used on Preset for this connection - **Account** with the account identifier. Refer to the [Snowflake documentation](https://docs.snowflake.com/en/user-guide/admin-account-identifier.html#non-vps-account-locator-formats-by-cloud-platform-and-region) to identify the structure to your Cloud Provider and Region. - **Warehouse** and **Role** with the relevant warehouse (e.g., `COMPUTE_WH`) and role (e.g., `ACCOUNTADMIN`) that should be used when running queries. ![Snowflake Dynamic Form.png](https://cdn.document360.io/4749ddf8-aa05-4f3f-80e1-07a5d2d0f137/Images/Documentation/image%28280%29.png) Click on **Connect** to create the connection. At this stage, you can optionally configure **Advanced** options, if needed. To learn more, please see [Advanced Connection Settings](/v1/docs/advanced-connection-settings). ![GSheet_Public_Advanced_Step_3_of_3](https://cdn.document360.io/4749ddf8-aa05-4f3f-80e1-07a5d2d0f137/Images/Documentation/GSheet_Public_Advanced_Step_3_of_3.png) To finalize the connection, select **Finish**. Great job! --- ## Connect using an encrypted key pair It's also possible to connect to Snowflake authenticating with an [encrypted key pair](https://docs.snowflake.com/en/user-guide/key-pair-auth#step-6-configure-the-snowflake-client-to-use-key-pair-authentication) instead of a password, using a SQLAlchemy String URI. ![image.png](https://cdn.document360.io/4749ddf8-aa05-4f3f-80e1-07a5d2d0f137/Images/Documentation/image%28211%29.png) In the **Display Name field**, enter a meaningful name for the new connection to Snowflake. In the **SQLAlchemy URI field**, customize your URI connection string using the following syntax: ``` snowflake://@/?role=&warehouse= ``` Configuring Snowflake database connection with MFA caching using SQLAlchemy URI If you have a need to configure the Snowflake database connection with MFA caching. You will just need to add the following two parameters into the URI. 1. authenticator=username_password_mfa 2. client_request_mfa_token=True The example SQLAlchemy URI would look something like this ``` snowflake://@/?authenticator=username_password_mfa&client_request_mfa_token=True&role=&warehouse= ``` By doing so this enables MFA authentication with support for token caching, useful for environments requiring enhanced security without re-authentication on every session. ![image.png](https://cdn.document360.io/4749ddf8-aa05-4f3f-80e1-07a5d2d0f137/Images/Documentation/image%28213%29.png) Then, navigate to the **ADVANCED** tab, expand the **Security** section and use add below JSON structure to the **SECURE EXTRA** field: ``` { "auth_method": "keypair", "auth_params": { "privatekey_body": "Your Private Key", "privatekey_pass":"Your Private Key Password" } } ``` Note that the `privatekey_body` should receive a single line value, so replace line breaks with `\n`. For example: ``` { "auth_method": "keypair", "auth_params": { "privatekey_body": "-----BEGIN ENCRYPTED PRIVATE KEY-----\n...\n...\n-----END ENCRYPTED PRIVATE KEY-----", "privatekey_pass":"my_password" } } ``` Navigate back to the **Basic** tab, and click on **Test Connection** to validate the information is correct. Lastly, click on **Connect** to save the connection. --- ### Updating the connection method from username password to encrypted keypair Sometimes you might want to update the existing Snowflake connection from the username password method to the encrypted keypair method. You can do so by just following a few easy steps below: 1. Edit the existing Snowflake database connection you want to make changes to. 2. Clear the Password field. 3. Switch to the Advanced > Security tab. 4. Insert the Keypair JSON structure to the Secure extra field. 5. Click Finish. There you have it, you have successfully updated the connection method from username password to encrypted keypair. --- ## Connect using OAuth The OAuth integration allows Preset to run queries while impersonating users. When implemented, users are prompted to grant consent to the integration, which generates a token to be used for each user. Refer to the [Snowflake documentation](https://docs.snowflake.com/en/user-guide/oauth-snowflake-overview) for additional context. ### Setting up the OAuth integration in Snowflake Below SQL query can be used to set up an OAuth integration in Snowflake named `PRESET`: ``` CREATE SECURITY INTEGRATION PRESET TYPE = OAUTH ENABLED = TRUE OAUTH_CLIENT = CUSTOM OAUTH_CLIENT_TYPE = 'CONFIDENTIAL' OAUTH_USE_SECONDARY_ROLES = 'IMPLICIT' OAUTH_ALLOW_NON_TLS_REDIRECT_URI = FALSE OAUTH_REDIRECT_URI = 'https://${WORKSPACE}/api/v1/database/oauth2/'; ``` Replace `${WORKSPACE}` with the Workspace domain URL you'll connect to Snowflake. The structure is `https://${WorkspaceSlug}.${WorkspaceRegion}.app.preset.io`. Once the integration is created, run below SQL query to get the required information: ``` SELECT JSON_EXTRACT_PATH_TEXT(SYSTEM$SHOW_OAUTH_CLIENT_SECRETS('PRESET'), 'OAUTH_CLIENT_ID') as "Client ID", JSON_EXTRACT_PATH_TEXT(SYSTEM$SHOW_OAUTH_CLIENT_SECRETS('PRESET'), 'OAUTH_CLIENT_SECRET') as "Client Secret"; ``` Fill the Snowflake connection form in Preset: - **Database Name** with name of the database that you are connecting to - **Display Name** with the name to be used on Preset for this connection - **Account** with the account identifier. Refer to the [Snowflake documentation](https://docs.snowflake.com/en/user-guide/admin-account-identifier.html#non-vps-account-locator-formats-by-cloud-platform-and-region) to identify the structure to your Cloud Provider and Region. - **Warehouse** with the warehouse that should be used for the connection. Then, expand the **OAuth2 client information section** and provide: - The **Client ID** and **Client Secret** values retrieved with the SQL query - Use `https://${ACCOUNT-URL}/oauth/authorize` as the **Authorization Request URI** - Use `https://${ACCOUNT-URL}/oauth/token-request` as the **Token Request URI** - Use `refresh_token` in the **Scope** field. Note that you can also [optionally limit the role that's used by the integration](https://docs.snowflake.com/en/user-guide/oauth-custom#scope). ![Snowflake OAuth form.png](https://cdn.document360.io/4749ddf8-aa05-4f3f-80e1-07a5d2d0f137/Images/Documentation/image%28281%29.png) Click on the **Connect** button. If the information is correct, the connection is created and you are redirected to the **Advanced** tab. Expand the **Security** section and enable the **Impersonate logged in user** option, and finally click on **FINISH**. To test the integration: 1. Navigate to **SQL > SQL Lab**. 2. Select the Snowflake connection in the **Database** dropdown. 3. You should see an **Authorization needed** error. Click on **See more**. 4. Click on the **provide authorization** hyperlink to be redirected to Snowflake. Authenticate using your Snowflake credentials and grant consent for the integration. 5. After authentication, you're redirected back to Preset. Refresh the page. Queries should now be properly authenticated with your OAuth token. Note that this **Authorization needed** prompt will be displayed to all users the first time they interact with this database (either in SQL Lab or via charts). ### Fallback credentials for Embedded dashboards Beta feature The fallback credentials for Embedded dashboards is currently **on Beta**. Reach out to the Preset Support Team to have this feature enabled. Also, Dashboard Embedding is an add-on available on the [Enterprise and Professional plans](https://preset.io/pricing/?utm_source=Preset-Docs&utm_medium=Referral&utm_campaign=Preset-Docs). Embedded users cannot generate and store their own OAuth2 tokens. With the fallback enabled, queries triggered in Embedded mode use a shared credential configured on the DB connection. Before you begin, make sure that: - Your Snowflake OAuth2 database connection is working. - Your Embedded configuration is complete. - The embedded authentication fallback is enabled for your team. To configure the shared credential: 1. Edit your Snowflake OAuth2 database connection. 2. Access the **Advanced** tab and expand the **Security** section. 3. Copy the contents of **Secure Extra** into a text editor. This field contains a JSON object with your OAuth2 configuration, for example: ``` { "oauth2_client_info": { "id": "MyOAuth2ClientSecret", "secret": "XXXXXXXXXX", "authorization_request_uri": "https://SNOWFLAKE-ACCOUNT.snowflakecomputing.com/oauth/authorize", "token_request_uri": "https://SNOWFLAKE-ACCOUNT.snowflakecomputing.com/oauth/token-request", "scope": "refresh_token" } } ``` 1. Add `embedded_credentials` as a top-level property alongside `oauth2_client_info`, using one of the options below. Preserve the existing OAuth2 configuration and any other properties. **Option A: Password or Personal Access Token (PAT)** ``` { "oauth2_client_info": { "id": "MyOAuth2ClientSecret", "secret": "XXXXXXXXXX", "authorization_request_uri": "https://SNOWFLAKE-ACCOUNT.snowflakecomputing.com/oauth/authorize", "token_request_uri": "https://SNOWFLAKE-ACCOUNT.snowflakecomputing.com/oauth/token-request", "scope": "refresh_token" }, "embedded_credentials": { "username": "$SNOWFLAKE_USER", "password": "$PASSWORD_OR_PAT" } } ``` *Replace `$SNOWFLAKE_USER` with the username for the Snowflake account and `$PASSWORD_OR_PAT` with the password or PAT for the account.* **Option B: Key pair** ``` { "oauth2_client_info": { "id": "MyOAuth2ClientSecret", "secret": "XXXXXXXXXX", "authorization_request_uri": "https://SNOWFLAKE-ACCOUNT.snowflakecomputing.com/oauth/authorize", "token_request_uri": "https://SNOWFLAKE-ACCOUNT.snowflakecomputing.com/oauth/token-request", "scope": "refresh_token" }, "embedded_credentials": { "username": "$SNOWFLAKE_USER", "auth_method": "keypair", "privatekey_pass": "$PASSPHRASE", "privatekey_body": "$PRIVATE_KEY" } } ``` *Replace `$SNOWFLAKE_USER` with the username for the Snowflake account, `$PRIVATE_KEY` with the private key matching the public key stored in Snowflake and `$PASSPHRASE` with the key passphrase. If the private key has no passphrase, omit the `privatekey_pass` line entirely.* 1. Paste the complete updated JSON back into **Secure Extra**, and click on **Finish** to save changes. --- ## Snowflake Identifier Case Sensitivity and Metric Naming Best Practices After connecting a Snowflake database to Preset, it is also crucial to understand how identifier case sensitivity in Snowflake works to avoid frustrating SQL errors. ### Snowflake’s Case Sensitivity Behavior Snowflake automatically converts all **unquoted** identifiers (such as column names, table names, and aliases) to uppercase. For example, using `sales_amount` in a query is interpreted as `SALES_AMOUNT`. However, when using double quotes, Snowflake preserves the exact casing. So `"sales_amount"` and `"SALES_AMOUNT"` are treated as two different identifiers. This distinction becomes critical when referencing metrics or calculated fields that were created with specific casing. ### Guidance on Metric Definitions To avoid issues, try adopting one of two approaches when defining and referencing metrics: 1. Use uppercase consistently (e.g., TOTAL_REVENUE) so Snowflake’s default behavior works correctly. 2. Use double quotes for mixed/lowercase names (e.g., "totalRevenue"), especially when referencing them in calculated columns or custom SQL metrics. Failing to do so often results in queries that cannot find the intended column or metric. ### Common SQL Errors and How to Fix Them The following are common errors users encounter: 1. `SQL compilation error: invalid identifier 'totalRevenue'` This happens because Snowflake interprets **totalRevenue** as **TOTALREVENUE**, which does not match the actual identifier. Resolution: Wrap the identifier in double quotes: ``` SELECT "totalRevenue" FROM my_table; ``` 1. Defining a metric as **"NetProfit"** but later referencing it as **NetProfit** (unquoted) → Snowflake looks for **NETPROFIT** instead. Resolution: Always match the exact case with quotes: ``` SELECT "NetProfit" / "Revenue" FROM my_table; ``` ### Best Practices for Preset and Snowflake 1. Use consistent naming conventions (preferably all uppercase with underscores, e.g., NET_PROFIT). 2. Avoid mixed-case identifiers unless necessary. 3. If you must use mixed case, always use double quotes consistently in every SQL reference. 4. Align naming conventions across datasets, metrics, and aliases to reduce confusion. Tip: Test custom SQL expressions early to catch identifier mismatches before building charts or dashboards on top of them. These practices will minimize case-sensitivity issues and ensure smoother development of metrics, charts, and dashboards in Preset.