---
schema_version: "1"
id: 11fe78ceef6b7446c3679376eaff71ebb1176e96bb6733357d9154a104e1e586
title: Define a Named Credential for Salesforce Connect SQL Adapter for Snowflake
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/platform/264-0-0/snowflake_named_credentials_external_credentials.md
canonical_url: https://help.salesforce.com/s/articleView?id=platform.snowflake_named_credentials_external_credentials.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: be02afd77972aa02316d17b27948fca79f48021b09eb2b46824f1a628f43d5a7
description: Create a named credential that specifies the endpoint URL for Snowflake and an external credential to provide the required authentication parameters.
products:
  - Salesforce Platform
  - Security
release: "264"
---
# Define a Named Credential for Salesforce Connect SQL Adapter for Snowflake

Create a named credential that specifies the endpoint URL for Snowflake and an external credential to provide the required authentication parameters.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: all editions</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
          <colgroup>
            <col style="width:50%">
            <col style="width:50%">
          </colgroup>
          <thead class="slds-text-title_caps ">
            <tr class="">
              <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d38851e64">User Permissions Needed</th>
            </tr>
          </thead>
          <tbody>
            <tr class="">
              <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d38851e64 ">To view named credentials:</td>

              <td class="slds-cell-wrap" style="vertical-align:top;" headers="d38851e64 ">View Setup and Configuration</td>

            </tr>
            <tr class="">
              <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d38851e64 ">To create, edit, or delete named credentials:</td>

              <td class="slds-cell-wrap" style="vertical-align:top;" headers="d38851e64 ">Manage Named Credentials or Customize Applications</td>

            </tr>
          </tbody>
        </table>

When you use the Salesforce Connect adapter for SQL to integrate with Snowflake, Salesforce acts as a client (consumer) of Snowflake’s services. Enabling connectivity between services requires additional configuration in both Salesforce and Snowflake. To integrate Salesforce and Snowflake, perform this series of tasks.

1. In Salesforce, configure an authentication provider, and copy its redirect URI for the OAuth flow.
2. In Snowflake, configure an integration that references the redirect URI from Salesforce.
3. In Salesforce, update the authentication provider that you created with parameters from the Snowflake integration.
4. If your Snowflake account is configured so that AWS PrivateLink bypasses the public internet, set up an outbound connection in Salesforce to send traffic from Salesforce to your AWS Virtual Private Cloud (VPC).
5. In Salesforce, create an external credential that uses the authentication provider that you configured.
6. In Salesforce, create a named credential that uses the external credential that you configured.

## Configure an Authentication Provider in Salesforce

To get started, create an authentication provider using OpenID Connect in Salesforce.

Give the authentication provider a name like Snowflake, and enter placeholder values in other required fields. You update these fields after you create the integration in Snowflake. For more information, see [Configure an Authentication Provider Using OpenID Connect](https://help.salesforce.com/s/articleView?id=xcloud.sso_provider_openid_connect.htm&type=5&language=en_US).

After you create the authentication provider, on the Auth. Provider Detail page, copy the callback URL that Salesforce generated. When you create the integration in Snowflake, the callback URL is the redirect URI that redirects the Salesforce admin back to Salesforce after they authenticate in Snowflake.

## Configure an Integration in Snowflake

Next, create an integration in Snowflake to enable access to Snowflake’s SQL API. We recommend using Snowflake OAuth for custom clients.

Name the integration Salesforce, and use the callback URL that you copied from Salesforce as the value for the OAUTH\_REDIRECT\_URI. For more information, see [Configure Snowflake OAuth for Custom Clients](https://docs.snowflake.com/en/user-guide/oauth-custom).

After you create the integration, use this Snowflake query to see the Salesforce integration’s parameters.

```html
DESCRIBE INTEGRATION SALESFORCE;
```

In the query results, retrieve and save these values to add to the authentication provider that you created in Salesforce.

- `OAUTH_CLIENT_ID`
- `OAUTH_AUTHORIZATION_ENDPOINT`
- `OAUTH_TOKEN_ENDPOINT`

Next, retrieve the client secret. Use this query and save the `OAUTH_CLIENT_SECRET` that Snowflake returns.

```html
SELECT SYSTEM$SHOW_OAUTH_CLIENT_SECRETS( 'SALESFORCE' );
```

Before you create external and named credentials in Salesforce, we also recommend creating a user with no administrator privileges in your Snowflake account. Assign the Snowflake user a role that isn’t ACCOUNTADMIN or SYSTEMADMIN, and grant the user access to the appropriate warehouse, database, schema, and tables. For more information, see [Configuring Access Control](https://docs.snowflake.com/en/user-guide/security-access-control-configure) in the Snowflake documentation.

## Update the Authentication Provider in Salesforce

Next, in Salesforce, update the authentication provider that you created with the values from the Snowflake integration.

 
| Salesforce Authentication Provider Field | Snowflake Integration Value |
| --- | --- |
| Consumer Key | `OAUTH_CLIENT_ID` |
| Consumer Secret | `OAUTH_CLIENT_SECRET` |
| Authorize Endpoint URL | `OAUTH_AUTHORIZATION_ENDPOINT` |
| Token Endpoint URL | `OAUTH_TOKEN_ENDPOINT` |

## Establish an Outbound Connection with AWS in Salesforce

If your Snowflake account is configured so that AWS PrivateLink bypasses the public internet, you must set up a Private Connect outbound connection in Salesforce to send traffic from Salesforce to your AWS VPC. If your Snowflake account doesn’t use AWS PrivateLink, skip this task.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-extend_click-264-0-0-production-enus/5f7d9219-b7b1-4552-8891-f1aba9b289fc/images/icon_note.png)

Note Private Connect is available for purchase as an add-on license. See [Secure Cross-Cloud Integrations with Private Connect](https://help.salesforce.com/s/articleView?id=xcloud.private_connect_overview.htm&type=5&language=en_US).

Before you create the outbound connection in Salesforce, work with your Snowflake admin or Snowflake Support to allow Salesforce to connect privately. See [AWS PrivateLink and Snowflake](https://docs.snowflake.com/en/user-guide/admin-security-privatelink) and [Allowing Hostnames](https://docs.snowflake.com/en/user-guide/hostname-allowlist) in the Snowflake documentation.

You must also work with your Snowflake admin to allowlist the Salesforce AWS account for Snowflake. In Snowflake, identify your account’s AWS region. Then, from Salesforce Setup, in the Quick Find box, enter Private, and then click Private Connect. Open the AWS Regions list and find the row for the AWS region that your Snowflake account is in. In the IAM Role column, identify the AWS account number and share it with your Snowflake admin so that they can add the account to the list of allowed hostnames.

![Screen showing a list of AWS regions with an example of AWS account number, highlighted](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-extend_click-264-0-0-production-enus/5f7d9219-b7b1-4552-8891-f1aba9b289fc/extend_click/images/integrate_connectors_snowflakevpc_aws_account.png)

After your Salesforce account is allowlisted, return to Snowflake and run this query.

```
SELECT SYSTEM$GET_PRIVATELINK_CONFIG();
```

In the query results, retrieve and save the values of `PRIVATELINK-VPCE-ID` and `PRIVATELINK-ACCOUNT-URL` to add to the outbound connection and named credential in Salesforce. We also recommend saving the `PRIVATELINK-ACCOUNT-NAME` to help you troubleshoot issues with the Snowflake team.

In Salesforce, create the outbound connection.

1. From Setup, in the Quick Find box, enter Private, and then click **Private Connect**.
2. Click **Create Outbound Connection**, select **AWS PrivateLink**, and then click **Next**.
3. Complete the fields.
    
     
    | Field | Description |
    | --- | --- |
    | Connection Name | Enter a name that references the external system, such as `SnowflakeOutboundConnection`. |
    | VPC Endpoint Service Name | Enter the `PRIVATELINK-VPCE-ID` value that you copied from the Snowflake account. For example, `com.amazonaws.vpce.us-west-2.vpce-svc-025d08f3df604a276`. |
    | Region | Select the AWS region in which your VPC is hosted. For example, for the VPC endpoint `com.amazonaws.vpce.us-west-2.vpce-svc-025d08f3df604a276`, the AWS region is `us-west-2`. |
4. Select **Yes, I would like to provision my connection now**.
5. Save the connection.

## Create an External Credential for the Snowflake Integration

Now you’re ready to create an external credential in Salesforce. We recommend using the OAuth 2.0 Browser Flow with the authentication provider that you created for the Snowflake account.

1. From Setup, in the Quick Find box, enter Named Credentials, and then select **Named Credentials**.
2. Click **External Credentials**.
3. To create an external credential, click **New**.
4. Complete the fields.
    
     
    | Field | Description |
    | --- | --- |
    | Label | A user-friendly name for the external credential that’s displayed in the Salesforce user interface, such as in list views. |
    | Name | A unique identifier that’s used to refer to this external credential from callout definitions while creating an external data source for Snowflake. |
    | Authentication Protocol | Select **OAuth 2.0**. |
    | Authentication Flow Type | Select **Browser Flow**. |
    | Scope | To allow offline access, enter `refresh_token`. |
    | Authentication Provider | Select the authentication provider that you created to access Snowflake. |
5. Save the external credential.

You’re taken to the Named Credentials screen.

## Create the External Credential Principal

Next, create the principal, authenticate to the external system, and grant access to Salesforce users.

1. On the Named Credentials screen, scroll to the Principals section.
2. To create a principal, click **New**.
3. Enter the information for the principal.
    
    <table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
                <colgroup>
                  <col style="width:25%">
                  <col style="width:75%">
                </colgroup>
                <thead class="slds-text-title_caps ">
                  <tr class="">
                    <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d38851e817">Field</th>
                    <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d38851e820">Description</th>
                  </tr>
                </thead>
                <tbody>
                  <tr class="">
                    <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d38851e817 ">
                      <samp class="parmname">Parameter Name</samp>
                    </td>

                    <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d38851e820 ">Enter a name that references the external system, such as
                      <kbd>SnowflakeIntegrationUser</kbd>.
                    </td>

                  </tr>
                  <tr class="">
                    <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d38851e817 ">
                      <samp class="parmname">Sequence Number</samp>
                    </td>

                    <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d38851e820 ">Assign a sequence number. A sequence number specifies the order of principals to
                      apply when a user participates in more than one principal. For example, a user can be part
                      of multiple permission sets that are applicable for a credential provider. Priority is
                      from lower to higher numbers.</td>

                  </tr>
                  <tr class="">
                    <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d38851e817 ">
                      <samp class="parmname">Identity Type</samp>
                    </td>

                    <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d38851e820 ">
                      <p>Select <strong class="uicontrol">Named Principal</strong>. </p>
                      <p style="margin-bottom:0;">With the Named Principal identity
                        type, your organization uses only one login account to access the Snowflake external
                        system.</p>
                    </td>

                  </tr>
                  <tr class="">
                    <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d38851e817 ">
                      <samp class="parmname">Scope</samp>
                    </td>

                    <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d38851e820 ">
                      <p>Optional. The Scope field accepts static values and formulas. To tie a group of
                        authenticated users to a role in the Snowflake system, enter <code>session:role:&lt;snowflake role&gt;</code>.</p>
                      <p>For example, if at run time the user has
                        Sales or Service in their department name, set a static scope of <code>session:role:CUSTOMER_SERVICE</code>.</p>
                      <p>Or enter a formula to
                        request access dynamically. This example uses the <code>session:role</code> scope to request credential-level access based on each user’s
                        department.</p>
                      <pre class="line-numbers slds-box slds-box_x-small slds-theme_shade slds-m-top_medium slds-m-bottom_medium slds-scrollable_x"><code>{!"session:role:" + $User.Department}</code></pre>
                    </td>

                  </tr>
                </tbody>
              </table>
4. Save the principal.
5. To authenticate the principal, click its **Actions** menu, and then select **Authenticate**.
    
    You’re taken to Snowflake. Enter your login credentials, and then return to the Setup page in Salesforce to finish creating the external and named credentials.
6. In Salesforce, create or update a permission set to grant principal access so that users can make authenticated callouts to Snowflake. See [Enable External Credential Principals](https://help.salesforce.com/s/articleView?id=xcloud.nc_enable_ext_cred_principal.htm&type=5&language=en_US).

## Create a Named Credential for the Snowflake Integration

Finally, create a named credential that uses the authentication configuration that you defined in the external credential.

1. From Setup, in the Quick Find box, enter Named Credentials, and then click **Named Credentials**.
2. To create a named credential, click **New**.
3. Complete the fields.
    
    <table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
                <colgroup>
                  <col style="width:25%">
                  <col style="width:75%">
                </colgroup>
                <thead class="slds-text-title_caps ">
                  <tr class="">
                    <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d38851e1001">Field</th>
                    <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d38851e1004">Description</th>
                  </tr>
                </thead>
                <tbody>
                  <tr class="">
                    <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d38851e1001 ">
                      <samp class="parmname">Label</samp>
                    </td>

                    <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d38851e1004 ">A user-friendly name for the named credential that’s shown in the Salesforce user
                      interface, such as in list views.</td>

                  </tr>
                  <tr class="">
                    <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d38851e1001 ">
                      <samp class="parmname">Name</samp>
                    </td>

                    <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d38851e1004 ">A unique identifier that’s used to refer to this named credential from a callout
                      definition while creating an external data source for Snowflake.</td>

                  </tr>
                  <tr class="">
                    <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d38851e1001 ">
                      <samp class="parmname">URL</samp>
                    </td>

                    <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d38851e1004 ">
                      <p>Enter a region-based URL with the format <code>https://<var>your snowflake
           org</var>.snowflakecomputing.com/api/v2/statements/</code>.</p>
                      <p>For example, if the
                        Snowflake org is <kbd>qab39024.us-east-1</kbd>, the URL is <code>https://qab39024.us-east-1.snowflakecomputing.com/api/v2/statements/</code>.
                      </p>
                      <p>To retrieve your Snowflake org, use this
                        command.</p>
                      <pre class="line-numbers slds-box slds-box_x-small slds-theme_shade slds-m-top_medium slds-m-bottom_medium slds-scrollable_x"><code>SELECT CURRENT_ACCOUNT();</code></pre>
                      <p>If
                        your URL doesn’t include a region, you must include the Snowflake account as a custom
                        HTTP header. See more information in the description of the <samp class="parmname">Allow Formulas in
                          HTTP Header</samp> field.</p>
                      <p style="margin-bottom:0;">If your Snowflake account uses AWS PrivateLink to
                        bypass the public internet, enter the <code>PRIVATELINK-ACCOUNT-URL</code> value that you copied from the Snowflake account
                        appended with <code>/api/v2/statements/</code>. For example,
                        <code>https://qab39024.us-east-1.privatelink.snowflakecomputing.com/api/v2/statements/</code>.
                      </p>
                    </td>

                  </tr>
                  <tr class="">
                    <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d38851e1001 ">
                      <samp class="parmname">External Credential</samp>
                    </td>

                    <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d38851e1004 ">Select the Snowflake external credential you created that uses the OAuth 2.0
                      authentication protocol with the Browser Flow.</td>

                  </tr>
                  <tr class="">
                    <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d38851e1001 ">
                      <samp class="parmname">Generate Authorization Header</samp>
                    </td>

                    <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d38851e1004 ">Select this checkbox so that Salesforce generates an authorization header and
                      applies it to each callout that references the named credential.</td>

                  </tr>
                  <tr class="">
                    <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d38851e1001 ">
                      <samp class="parmname">Allow Formulas in HTTP Header</samp>
                    </td>

                    <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d38851e1004 ">
                      <p>Optional. Select this checkbox if the named credential’s URL doesn’t include a
                        region. Then, after you save the named credential, add the Snowflake account as a custom
                        HTTP header. Enter <kbd>Snowflake-Account</kbd> as the custom header’s name,
                        and then enter the Snowflake account locator, for example <kbd>xy12345</kbd>,
                        as the custom header’s value.</p>
                      <p style="margin-bottom:0;">For more information about how to create a custom header,
                        see <a href="https://help.salesforce.com/s/articleView?id=xcloud.nc_cred_custom_headers.htm&amp;type=5&amp;language=en_US" target="_blank">Custom Headers for
                          Credentials</a>. For more information about how to find the Snowflake account
                        locator, see <a href="https://docs.snowflake.com/en/user-guide/admin-account-identifier" target="_blank">Account Identifiers</a> in the Snowflake
                        documentation.</p>
                    </td>

                  </tr>
                  <tr class="">
                    <td data-label="Field" class="slds-cell-wrap" style="vertical-align:top;" headers="d38851e1001 ">
                      <samp class="parmname">Outbound Network Connection</samp>
                    </td>

                    <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d38851e1004 ">Optional. If your Snowflake account uses AWS PrivateLink to bypass the public
                      internet, select the Private Connect outbound connection that you created to access
                      Snowflake. All callouts from Salesforce that use this named credential are routed through
                      the private connection.</td>

                  </tr>
                </tbody>
              </table>
4. Save your changes.

Use the named credential that captures the authentication configuration in external credentials to:

- Authenticate Salesforce users against Snowflake.
- Provide limited access to Snowflake resources.
- Periodically refresh access tokens.

#### See Also

- [Named Credentials and External Credentials](https://help.salesforce.com/s/articleView?id=xcloud.nc_named_creds_and_ext_creds.htm&type=5&language=en_US)