myorg-myaccount, or the legacy locator xy12345.us-east-1, whatever sits in front of .snowflakecomputing.com. The form has no host or port field at all.
The Snowflake connection form with an account identifier
Quick setup
Click Create Connection…, select Snowflake, enter the Account Identifier, set Auth Method, and click Save & Connect. The form shows only the fields that method needs. Any account works: the driver speaks the same connector REST protocol as Snowflake’s own drivers, so there is no edition or version to match. The driver is not in the app. Picking in the Choose a Database sheet offers the download before the form opens, and opening a saved connection installs it without asking. Settings > Plugins > Browse > installs it up front. See Plugins.Connection settings
Connection URL
Snowflake registers no URL scheme. The CLI config stands in for one: name a section in CLI Connection Name, and every field left empty is read at connect from~/.snowflake/connections.toml, or a [connections.<name>] section of config.toml.
Authentication
Password
If the account enforces MFA, put a current code in MFA Passcode (TOTP); it expires in under a minute, so refresh it immediately before connecting. RunningALTER ACCOUNT SET ALLOW_CLIENT_MFA_CACHING = TRUE; as ACCOUNTADMIN ends that chore: connect once with a fresh code, and Snowflake returns an MFA token that TablePro keeps in the Keychain.
Key pair
Point Private Key File at an RSA private key in PKCS#8 (.p8) format, and add Private Key Passphrase for an encrypted key. Register the matching public key on the user first:
Browser SSO
Sends you to your identity provider in the default browser and catches the reply on a loopback port, giving up after 2 minutes. WithALLOW_ID_TOKEN = TRUE on the account, Snowflake also returns a sign-in token; it goes to the Keychain, and later connects skip the browser until it is rejected.
OAuth token
Paste an access token issued for the account. Nothing refreshes it for you.Browsing and sessions
The sidebar groups objects by database and schema. Object lists come fromSHOW commands, which the metadata service answers with no warehouse running; column details come from INFORMATION_SCHEMA, which needs one.
Toolbar pickers move the session to another Warehouse or Role with USE WAREHOUSE and USE ROLE, no reconnect. A tab bound to a second database stays on that session too: USE DATABASE runs ahead of its statements. One TablePro connection is one Snowflake session, held open while idle by a heartbeat.
Editing
GET_DDL supplies the DDL view. Grid saves bind values server-side, VARIANT, OBJECT, and ARRAY cells through PARSE_JSON. The structure editor refuses a change Snowflake would reject before anything runs:
SSL/TLS
No SSL/TLS pane, and no plaintext option. Every request is HTTPS to the account endpoint on port 443.Limitations
- No SSH tunnel. The form has no SSH pane, and the endpoint is reached over HTTPS only.
- A grid edit keys on the declared primary key, or on every column when there is none, and a duplicate key value updates or deletes every row that matches it. Snowflake never enforces key constraints, so check a table for duplicates before editing it.
Troubleshooting
394508, MFA is required
The account enforces MFA on password logins. Enter a current code in MFA Passcode (TOTP), or move to key-pair or browser SSO, which never prompt.394507, the passcode was rejected
The code was wrong or already expired. A rejected code is remembered and never resent, so open the connection settings and type a fresh one.JWT token is invalid
Key-pair auth. The JWT issuer carries your account locator and a timestamp, so check the identifier and the Mac’s clock, then confirm the public key is registered on the user.No databases in the sidebar
The connecting role needsUSAGE on the databases. Set Warehouse too: column metadata runs on INFORMATION_SCHEMA, which needs one.