# Connect Snowflake with OAuth or a key pair

## When to use this

You want agents or scheduled jobs querying Snowflake without a password in
anyone's hands, under a concurrency limit, with a read-only role. Snowflake's
JDBC driver is on Maven Central and takes either a key pair or an OAuth access
token, so no password needs to exist at all.

## Setup

### 1. The role

```sql
CREATE ROLE SWARMVIA_READER;
GRANT USAGE ON WAREHOUSE ANALYTICS TO ROLE SWARMVIA_READER;
GRANT USAGE ON DATABASE SALES TO ROLE SWARMVIA_READER;
GRANT USAGE ON ALL SCHEMAS IN DATABASE SALES TO ROLE SWARMVIA_READER;
GRANT SELECT ON ALL TABLES IN DATABASE SALES TO ROLE SWARMVIA_READER;
CREATE USER SWARMVIA_SVC DEFAULT_ROLE = SWARMVIA_READER TYPE = SERVICE;
GRANT ROLE SWARMVIA_READER TO USER SWARMVIA_SVC;
```

The role is the boundary. Snowflake honours the driver's read-only request,
but a `SELECT`-only role makes the question moot.

### 2. The driver and the source

**Sources → New source → JDBC data source → Snowflake.** The preset fetches
`net.snowflake:snowflake-jdbc` from Maven Central into your organization's
drivers on first use. Fill the placeholders: account identifier
(`orgname-accountname`), warehouse, database, role. The URL becomes:

```
jdbc:snowflake://acme-prod.snowflakecomputing.com/?warehouse=ANALYTICS&db=SALES&role=SWARMVIA_READER
```

### 3a. Key pair

Generate a PKCS#8 key and register the public half on the user
(`ALTER USER SWARMVIA_SVC SET RSA_PUBLIC_KEY = '…'`). The preset seeds the
public property `user` on the source and `private_key_file` with the value
`${file:rsa_key.p8}`; upload the private key as the file `rsa_key.p8` on the
credential so the driver finds it. An encrypted key takes
`private_key_file_pwd` as a secret property.

### 3b. OAuth 2.0 client credentials

Create a Snowflake security integration for your identity provider (Okta,
Entra ID) with a client-credentials flow and the scope
`session:role:SWARMVIA_READER`. On the credential choose *OAuth 2.0 client
credentials*, enter the provider's token URL, client id and secret, and name
the token property `token`. The preset sets `authenticator=oauth` for you.
swarmvia refreshes the token; the driver never does.

### 4. Query

```bash
curl https://snowflake.swarmvia.cloud \
  -H "X-Swarmvia-Key: $SWARMVIA_KEY" \
  -H "content-type: application/json" \
  -d '{"queries":[{"sql":"SELECT region, SUM(amount) FROM orders WHERE order_date >= ? GROUP BY 1","params":["2026-01-01"]}]}'
```

Values arrive as the text Snowflake prints: `NUMBER` columns are strings, so
an agent that wants arithmetic casts them.

## Tips

- Set the warehouse's auto-suspend low; every swarmvia query is a fresh
  connection and a suspended warehouse resumes on the first one.
- Snowflake's query result cache works across connections, so repeated agent
  questions are cheap.
- If wide rows hit `max_result_bytes`, lower `maxRows` per query.

## See also

- [JDBC sources](/docs/sources/jdbc)
- [Refresh access tokens](/docs/knowledge-base/refresh-access-tokens)