---
schema_version: "1"
id: 6c8f6cf29d0d36b2c00243ffee97dc4898740424a3f2ff2fd147448b966bcf61
title: Setup OAuth and Provider for Snowflake Private Connection
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/analytics/264-0-0/bi_integrate_connectors_private_snowflake_oauth.md
canonical_url: https://help.salesforce.com/s/articleView?id=analytics.bi_integrate_connectors_private_snowflake_oauth.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: e6f295f5fb27e993c06b1362463b4f7cf21a7bfccc588ee0707ff51f75be0cd2
description: To use the CRM Analytics Snowflake private connector with an OAuth connection, you must configure Snowflake, Salesforce, CRM Analytics, an external OAuth authorization server, and an external auth identity provider.
products:
  - CRM Analytics
  - Cross Cloud
release: "264"
---
# Setup OAuth and Provider for Snowflake Private Connection

To use the CRM Analytics Snowflake private connector with an OAuth connection, you must configure Snowflake, Salesforce, CRM Analytics, an external OAuth authorization server, and an external auth identity provider.

## Connect to Snowflake with OAuth

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-analytics-bi-264-0-0-production-enus/ec791473-f5b4-4f64-a656-9104f455d966/images/icon_note.png)

Note

You can’t use a custom authorization provider.

This OAuth architecture is valid only for Snowflake virtual private connections.

These high-level instructions help you navigate the steps involved. Remember to contact your Network Security or IT department for help with configuration consistent with your organization’s security requirements.

1. Configure Snowflake and your selected external authorization server. Here’s [Snowflake's help](https://docs.snowflake.com/en/user-guide/oauth-intro.html), with detailed instructions for connecting to services like Okta.
2. With the authorization server is configured, follow the steps under _Define an Authentication Provider in Salesforce_ from [Configure an Authentication Provider Using OpenID](https://help.salesforce.com/s/articleView?id=xcloud.sso_provider_openid_connect.htm&language=en_US).
    - If you’re using Okta, here are [Okta's instructions](https://support.okta.com/help/s/article/How-to-connect-Salesforce-with-Okta-using-OpenID-Connect?language=en_US) for adding their service to Salesforce.
3. With the authentication provider added to Salesforce, [define a named credential](https://help.salesforce.com/s/articleView?id=xcloud.named_credentials_about.htm&language=en_US) in Salesforce. Select the OAuth 2.0 authentication protocol and Named Principal identity type. Use of External Credentials is not supported.
4. Add the Snowflake connection. For **Authentication Type** setting, enter OAuth.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-analytics-bi-264-0-0-production-enus/ec791473-f5b4-4f64-a656-9104f455d966/images/icon_note.png)

Note OAuth 2.0 is the industry-standard protocol for authorization, however we’re unable to test every possible combination of services. Log a case with Salesforce Support if your service can’t connect with the Authentication Provider system.

## Create an External Auth Identity Provider

1. From Setup, in the Quick Find box, enter Named, and then select **Named Credentials**.
2. On the **External Auth Identity Provider** tab, click **New**.
    
    ![New external auth identity provider screen showing authentication options.](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-analytics-bi-264-0-0-production-enus/ec791473-f5b4-4f64-a656-9104f455d966/resources-global/analytics/images/bi_integrate_connectors_snowflakevpc_external_auth_id_provider.png)
3. Enter a label and name.
4. For Authentication Protocol, select **OAuth 2.0**.
5. For Authentication Flow Type, select **Authorization Code (Browser Flow)**.
6. Use the client ID and client secret values from your Snowflake OAuth app
7. For the authorize and token endpoint URLs, provide the values from the Snowflake OAuth Metadata URI details found in the Security APIs section. There should be a separate URL value for each.
8. Save your external auth identity provider.
9. Open your new external auth identity provider and copy the Callback URL value.
    
    ![The callback URL in the external auth identity provider.](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-analytics-bi-264-0-0-production-enus/ec791473-f5b4-4f64-a656-9104f455d966/resources-global/analytics/images/bi_integrate_connectors_snowflakevpc_external_auth_callback.png)
10. Use the callback URL value in your Snowflake OAauth application, adding it to the Login values as the callback URL value for a sign-in redirect URI.