> ## Documentation Index
> Fetch the complete documentation index at: https://ngquct-docs-fix-500-query-results.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.
# Snowflake
> Connect to Snowflake with password, key-pair, SSO, or OAuth auth
export const name_0 = "Snowflake"
export const plugin_0 = "Snowflake Driver"
The account identifier is the whole address: `myorg-myaccount`, or the legacy locator `xy12345.us-east-1`, whatever sits in front of `.snowflakecomputing.com`. The form has no host or port field at all.
## Quick setup
Click **Create Connection…**, select **Snowflake**, enter the **Account Identifier**, set **Auth Method**, and click **Save & Connect**. The form shows only the fields that method needs. Any account works: the driver speaks the same connector REST protocol as Snowflake's own drivers, so there is no edition or version to match.
The {name_0} driver is not in the app. Picking {name_0} in the **Choose a Database** sheet offers the
download before the form opens, and opening a saved {name_0} connection installs it without asking.
**Settings > Plugins > Browse > {plugin_0}** installs it up front. See [Plugins](/features/plugins).
## Connection settings
| Field | Required | Notes |
| ----------------------- | ---------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Account Identifier** | Yes | `myorg-myaccount` or `xy12345.us-east-1` |
| **Auth Method** | Yes | Password, Key Pair, SSO (Browser), or OAuth Token |
| **Username** | Most | Password, key-pair, and SSO need it |
| Credentials | Per method | The form reveals what the method needs: **Password** with **MFA Passcode (TOTP)**, **Private Key File** with **Private Key Passphrase**, or **OAuth Token** |
| **Warehouse** | No | Compute warehouse such as `COMPUTE_WH` |
| **Database** | No | Default database. Empty browses all of them |
| **Schema** | No | Default schema, `PUBLIC` if empty |
| **Role** | No | Session role, Advanced pane |
| **CLI Connection Name** | No | Section in `~/.snowflake/connections.toml`, Advanced pane |
## Connection URL
Snowflake registers no URL scheme. The CLI config stands in for one: name a section in **CLI Connection Name**, and every field left empty is read at connect from `~/.snowflake/connections.toml`, or a `[connections.]` section of `config.toml`.
## Authentication
### Password
If the account enforces MFA, put a current code in **MFA Passcode (TOTP)**; it expires in under a minute, so refresh it immediately before connecting. Running `ALTER ACCOUNT SET ALLOW_CLIENT_MFA_CACHING = TRUE;` as ACCOUNTADMIN ends that chore: connect once with a fresh code, and Snowflake returns an MFA token that TablePro keeps in the Keychain.
### Key pair
Point **Private Key File** at an RSA private key in PKCS#8 (`.p8`) format, and add **Private Key Passphrase** for an encrypted key. Register the matching public key on the user first:
```sql theme={null}
ALTER USER jane_doe SET RSA_PUBLIC_KEY='MIIBIjANBgkq…';
```
Every connect signs a one-hour JWT with that key, so the Mac's clock has to be accurate.
### Browser SSO
Sends you to your identity provider in the default browser and catches the reply on a loopback port, giving up after 2 minutes. With `ALLOW_ID_TOKEN = TRUE` on the account, Snowflake also returns a sign-in token; it goes to the Keychain, and later connects skip the browser until it is rejected.
### OAuth token
Paste an access token issued for the account. Nothing refreshes it for you.
## Browsing and sessions
The sidebar groups objects by database and schema. Object lists come from `SHOW` commands, which the metadata service answers with no warehouse running; column details come from `INFORMATION_SCHEMA`, which needs one.
Toolbar pickers move the session to another **Warehouse** or **Role** with `USE WAREHOUSE` and `USE ROLE`, no reconnect. A tab bound to a second database stays on that session too: `USE DATABASE` runs ahead of its statements. One TablePro connection is one Snowflake session, held open while idle by a heartbeat.
## Editing
`GET_DDL` supplies the DDL view. Grid saves bind values server-side, VARIANT, OBJECT, and ARRAY cells through `PARSE_JSON`. The structure editor refuses a change Snowflake would reject before anything runs:
| Change | Result |
| ----------------------------------- | -------------------------- |
| Add, rename, or drop a column | Runs |
| Widen a VARCHAR | Runs. Shrinking is refused |
| Change NUMBER precision | Runs at the same scale |
| Any other type change | Refused |
| NOT NULL, comment, primary key | Runs |
| Set a column default to a new value | Refused. Clearing one runs |
## SSL/TLS
No SSL/TLS pane, and no plaintext option. Every request is HTTPS to the account endpoint on port 443.
## Limitations
* No SSH tunnel. The form has no SSH pane, and the endpoint is reached over HTTPS only.
* A grid edit keys on the declared primary key, or on every column when there is none, and a duplicate key value updates or deletes every row that matches it. Snowflake never enforces key constraints, so check a table for duplicates before editing it.
## Troubleshooting
### 394508, MFA is required
The account enforces MFA on password logins. Enter a current code in **MFA Passcode (TOTP)**, or move to key-pair or browser SSO, which never prompt.
### 394507, the passcode was rejected
The code was wrong or already expired. A rejected code is remembered and never resent, so open the connection settings and type a fresh one.
### JWT token is invalid
Key-pair auth. The JWT issuer carries your account locator and a timestamp, so check the identifier and the Mac's clock, then confirm the public key is registered on the user.
### No databases in the sidebar
The connecting role needs `USAGE` on the databases. Set **Warehouse** too: column metadata runs on `INFORMATION_SCHEMA`, which needs one.
### The browser never came back
Sign-in has 2 minutes, and the reply arrives on a loopback port. Allow the popup and retry.