Connect Snowflake with OAuth or a key pair

When to use this

You want agents or scheduled jobs querying Snowflake without a password in anyone's hands, under a concurrency limit, with a read-only role. Snowflake's JDBC driver is on Maven Central and takes either a key pair or an OAuth access token, so no password needs to exist at all.

Setup

1. The role

CREATE ROLE SWARMVIA_READER;
GRANT USAGE ON WAREHOUSE ANALYTICS TO ROLE SWARMVIA_READER;
GRANT USAGE ON DATABASE SALES TO ROLE SWARMVIA_READER;
GRANT USAGE ON ALL SCHEMAS IN DATABASE SALES TO ROLE SWARMVIA_READER;
GRANT SELECT ON ALL TABLES IN DATABASE SALES TO ROLE SWARMVIA_READER;
CREATE USER SWARMVIA_SVC DEFAULT_ROLE = SWARMVIA_READER TYPE = SERVICE;
GRANT ROLE SWARMVIA_READER TO USER SWARMVIA_SVC;

The role is the boundary. Snowflake honours the driver's read-only request, but a SELECT-only role makes the question moot.

2. The driver and the source

Sources → New source → JDBC data source → Snowflake. The preset fetches net.snowflake:snowflake-jdbc from Maven Central into your organization's drivers on first use. Fill the placeholders: account identifier (orgname-accountname), warehouse, database, role. The URL becomes:

jdbc:snowflake://acme-prod.snowflakecomputing.com/?warehouse=ANALYTICS&db=SALES&role=SWARMVIA_READER

3a. Key pair

Generate a PKCS#8 key and register the public half on the user (ALTER USER SWARMVIA_SVC SET RSA_PUBLIC_KEY = '…'). The preset seeds the public property user on the source and private_key_file with the value ${file:rsa_key.p8}; upload the private key as the file rsa_key.p8 on the credential so the driver finds it. An encrypted key takes private_key_file_pwd as a secret property.

3b. OAuth 2.0 client credentials

Create a Snowflake security integration for your identity provider (Okta, Entra ID) with a client-credentials flow and the scope session:role:SWARMVIA_READER. On the credential choose OAuth 2.0 client credentials, enter the provider's token URL, client id and secret, and name the token property token. The preset sets authenticator=oauth for you. swarmvia refreshes the token; the driver never does.

4. Query

curl https://snowflake.swarmvia.cloud \
  -H "X-Swarmvia-Key: $SWARMVIA_KEY" \
  -H "content-type: application/json" \
  -d '{"queries":[{"sql":"SELECT region, SUM(amount) FROM orders WHERE order_date >= ? GROUP BY 1","params":["2026-01-01"]}]}'

Values arrive as the text Snowflake prints: NUMBER columns are strings, so an agent that wants arithmetic casts them.

Tips

Set the warehouse's auto-suspend low; every swarmvia query is a fresh connection and a suspended warehouse resumes on the first one.
Snowflake's query result cache works across connections, so repeated agent questions are cheap.
If wide rows hit max_result_bytes, lower maxRows per query.