> ## Documentation Index
> Fetch the complete documentation index at: https://docs.paradime.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Snowflake OAuth

> Connect Snowflake to Paradime using Snowflake OAuth so each user authenticates through Snowflake with their own credentials and role.

export const Arcade = ({src, title}) => <div style={{
  position: 'relative',
  paddingBottom: 'calc(56.2225% + 41px)',
  height: 0,
  width: '100%'
}}>
    <iframe src={src} title={title} frameBorder="0" loading="lazy" allow="clipboard-write" allowFullScreen style={{
  position: 'absolute',
  top: 0,
  left: 0,
  width: '100%',
  height: '100%',
  colorScheme: 'light'
}} />
  </div>;

With Snowflake OAuth, users authorize their Code IDE credentials through Single Sign-On (SSO) via Snowflake rather than submitting a username and password to Paradime.

<Note>
  **Available in:** Code IDE only. The Bolt and Agent environments run non-interactively, so they use a dedicated service user with [username and password](/integrations/snowflake/username-and-password) or [key-pair authentication](/integrations/snowflake/key-pair) instead.
</Note>

If Snowflake is set up with SSO through a third-party identity provider, developers can use this method to log into Snowflake and authorize their dbt™ Code IDE credentials without any additional setup.

<Arcade src="https://demo.arcade.software/FYIOxg6CdsuHctSuy6BA?embed&embed_mobile=tab&embed_desktop=inline&show_copy_link=true" title="Snowflake OAuth" />

## Configuring a security integration

To enable Snowflake OAuth, create a [security integration](https://docs.snowflake.com/en/sql-reference/sql/create-security-integration.html) in Snowflake to manage the OAuth connection between Paradime and Snowflake.

<Warning>
  Only Snowflake account administrators (users with the `ACCOUNTADMIN` role) or a role with the global `CREATE INTEGRATION` privilege can execute this SQL command.
</Warning>

Execute the query below to create a security integration. See the full documentation on creating a security integration for custom clients [here](https://docs.snowflake.com/en/sql-reference/sql/create-security-integration.html).

```sql lineNumbers theme={"system"}
CREATE OR REPLACE SECURITY INTEGRATION PARADIME
  TYPE = OAUTH
  ENABLED = TRUE
  OAUTH_CLIENT = CUSTOM
  OAUTH_CLIENT_TYPE = 'CONFIDENTIAL'
  OAUTH_REDIRECT_URI = '<the redirect URI based on your paradime instance region>'
  OAUTH_ISSUE_REFRESH_TOKENS = TRUE
  OAUTH_USE_SECONDARY_ROLES = IMPLICIT
  OAUTH_REFRESH_TOKEN_VALIDITY = 7776000;
```

| Field                          | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| ------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `TYPE`                         | Required.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| `ENABLED`                      | Required.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| `OAUTH_CLIENT`                 | Required.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| `OAUTH_CLIENT_TYPE`            | Required.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| `OAUTH_REDIRECT_URI`           | Required. Use the redirect URI for your region (check your selected region during onboarding in **Workspace Settings > Workspace Management**):<br />🇪🇺 **eu-west-2 (Europe - London)**: `https://api.paradime.io/control-plane/snowflake/redirect`<br />🇪🇺 **eu-west-1 (Europe - Ireland)**: `https://eu-w1-api.paradime.io/control-plane/snowflake/redirect`<br />🇪🇺 **eu-central-1 (Europe - Frankfurt)**: `https://eu-c1-api.paradime.io/control-plane/snowflake/redirect`<br />🇺🇸 **us-east-1 (US East - N. Virginia)**: `https://api.us.paradime.io/control-plane/snowflake/redirect` |
| `OAUTH_ISSUE_REFRESH_TOKENS`   | Required.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| `OAUTH_REFRESH_TOKEN_VALIDITY` | Required. The number of seconds a refresh token is valid for. Use a smaller value to force users to re-authenticate with Snowflake more frequently.                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| `OAUTH_USE_SECONDARY_ROLES`    | Optional. Allows default secondary roles to be set in OAuth sessions.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |

## Retrieve the Client ID and Secret

To get the Client ID and Secret required to connect to Paradime, run the query below in Snowflake:

```sql lineNumbers theme={"system"}
with

integration_secrets as (
  select parse_json(system$show_oauth_client_secrets('PARADIME')) as secrets
)

select
  secrets:"OAUTH_CLIENT_ID"::string     as client_id,
  secrets:"OAUTH_CLIENT_SECRET"::string as client_secret
from
  integration_secrets;
```

## Enter the connection fields

<Info>
  This is a **Code IDE** method. An `Admin` sets the workspace-level fields (Profile Name, Target, Account, Client ID, Client Secret), and each developer sets their own user-level fields when authorizing their connection.
</Info>

| Field         | Description                                                                                                                                   | Example                                            |
| ------------- | --------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------- |
| Profile Name  | The profile name set in your `dbt_project.yml`. See more [here](https://docs.getdbt.com/docs/core/connect-data-platform/connection-profiles). | **`dbt-snowflake`**                                |
| Target        | The target name used to identify the connection. See more [here](https://docs.getdbt.com/reference/dbt-jinja-functions/target).               | **`dev`**                                          |
| Account       | The Snowflake account to connect to, as per [Snowflake's documentation](https://docs.snowflake.com/en/user-guide/admin-account-identifier).   | **`vj71689.eu-west-2.aws`**                        |
| Client ID     | The Client ID retrieved from the security integration above.                                                                                  | **`UPWBLFUTwT7hJ+JDbNthut3rF3w=`**                 |
| Client Secret | The Client Secret retrieved from the security integration above.                                                                              | **`7FMKYoOP9+KUh2qqVHXfsZStUJLpiaa/ojFmvGwr06E=`** |
| Role          | The role to assume when running queries as the specified user.                                                                                | **`transformer`**                                  |
| Database      | The name of your Snowflake database.                                                                                                          | **`analytics`**                                    |
| Warehouse     | The virtual warehouse to use for running queries.                                                                                             | **`transforming`**                                 |
| Schema        | The default schema used to build dbt™ objects at runtime.                                                                                     | **`dbt_john`**                                     |
| Threads       | The number of threads used in this connection. See more [here](https://docs.getdbt.com/docs/running-a-dbt-project/using-threads).             | **`8`**                                            |


## Related topics

- [BigQuery OAuth](/integrations/bigquery/oauth.md)
- [Starburst/Trino](/integrations/starburst-trino.md)
- [GitHub App](/integrations/github/github-app.md)
- [Google Workspace SSO](/products/single-sign-on/google-workspace-sso.md)
- [Snowflake](/integrations/snowflake/index.md)