> ## Documentation Index
> Fetch the complete documentation index at: https://docs.paradime.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Snowflake OAuth

> Snowflake OAuth: Configure OAuth for secure Snowflake connections with Paradime for dbt™ projects. Enhance data security and access.

export const Arcade = ({src, title}) => <div style={{
  position: 'relative',
  paddingBottom: 'calc(56.2225% + 41px)',
  height: 0,
  width: '100%'
}}>
    <iframe src={src} title={title} frameBorder="0" loading="lazy" allow="clipboard-write" allowFullScreen style={{
  position: 'absolute',
  top: 0,
  left: 0,
  width: '100%',
  height: '100%',
  colorScheme: 'light'
}} />
  </div>;

Paradime supports OAuth authentication with Snowflake. When Snowflake OAuth is enabled, users can authorize their Development credentials using Single Sign On (SSO) via Snowflake rather than submitting a username and password to Paradime.

<Card title="Snowflake" href="/products/settings/connections/development-environment/snowflake" horizontal icon="arrow-right" />

If Snowflake is setup with SSO through a third-party identity provider, developers can use this method to log into Snowflake and authorize the dbt™️ Development credentials without any additional setup.

<Arcade src="https://demo.arcade.software/FYIOxg6CdsuHctSuy6BA?embed&embed_mobile=tab&embed_desktop=inline&show_copy_link=true" title="Snowflake OAuth" />

## **Configuring a security integration**[**​**](https://app.paradime.io/_help/92e9662/connecting-dwh-snowflake#configuring-a-security-integration)

To enable Snowflake OAuth, you will need to create a [security integration](https://docs.snowflake.com/en/sql-reference/sql/create-security-integration.html) in Snowflake to manage the OAuth connection between Paradime and Snowflake.

<Warning>
  Note: Only Snowflake account administrators (users with the `ACCOUNTADMIN` role) or a role with the global `CREATE INTEGRATION` privilege can execute this SQL command.
</Warning>

In Snowflake, execute a query to create a security integration. Please find the complete documentation on creating a security integration for custom clients [here](https://docs.snowflake.com/en/sql-reference/sql/create-security-integration.html). You can find a sample create or replace security integration query below.

```sql lineNumbers theme={"system"}
CREATE OR REPLACE SECURITY INTEGRATION PARADIME
  TYPE = OAUTH
  ENABLED = TRUE
  OAUTH_CLIENT = CUSTOM
  OAUTH_CLIENT_TYPE = 'CONFIDENTIAL'
  OAUTH_REDIRECT_URI = '<the redirect URI based on your paradime instance region>'
  OAUTH_ISSUE_REFRESH_TOKENS = TRUE
  OAUTH_USE_SECONDARY_ROLES = IMPLICIT
  OAUTH_REFRESH_TOKEN_VALIDITY = 7776000;
```

| Field                           | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| ------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| TYPE                            | Required                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| ENABLED                         | Required                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| OAUTH\_CLIENT                   | Required                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| OAUTH\_CLIENT\_TYPE             | Required                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| OAUTH\_REDIRECT\_URI            | <p>Required. Use the correct domain, you can check your selected region during onboarding in the Workspace Management section of your Account Settings.<br /><br />🇪🇺 <strong>eu-west-2 (Europe - London)</strong><br /><code>[https://api.paradime.io/control-plane/snowflake/redirect](https://api.paradime.io/control-plane/snowflake/redirect)</code><br />🇪🇺 <strong>eu-west-1 (Europe - Ireland)</strong><br /><code>[https://eu-w1-api.paradime.io/control-plane/snowflake/redirect](https://eu-w1-api.paradime.io/control-plane/snowflake/redirect)</code><br />🇪🇺 <strong>eu-central-1 (Europe - Frankfurt)</strong><br /><code>[https://eu-c1-api.paradime.io/control-plane/snowflake/redirect](https://eu-c1-api.paradime.io/control-plane/snowflake/redirect)</code><br />🇺🇸 <strong>us-east-1 (US East - N. Virginia)</strong><br /><code>[https://api.us.paradime.io/control-plane/snowflake/redirect](https://api.us.paradime.io/control-plane/snowflake/redirect)</code></p> |
| OAUTH\_ISSUE\_REFRESH\_TOKENS   | Required                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| OAUTH\_REFRESH\_TOKEN\_VALIDITY | Required. This configuration dictates the number of seconds that a refresh token is valid for. Use a smaller value to force users to re-authenticate with Snowflake more frequently.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| OAUTH\_USE\_SECONDARY\_ROLES    | \[OPTIONAL] allow default secondary roles to be set in OAuth sessions.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |

## Retrieve ClientID and Secret

To get the Client ID and Secret required to connect to Paradime run the below query in Snowflake:

```sql lineNumbers theme={"system"}
with 

integration_secrets as (
  select parse_json(system$show_oauth_client_secrets('PARADIME')) as secrets
)

select
  secrets:"OAUTH_CLIENT_ID"::string     as client_id,
  secrets:"OAUTH_CLIENT_SECRET"::string as client_secret
from 
  integration_secrets;
```


## Related topics

- [Connection Security](/products/settings/connections/connection-security/index.md)
- [Snowflake](/products/settings/connections/development-environment/snowflake.md)
- [BigQuery OAuth](/products/settings/connections/connection-security/bigquery-oauth.md)
- [BigQuery](/products/settings/connections/development-environment/bigquery.md)
- [Starburst/Trino](/products/settings/connections/development-environment/starburst-trino.md)