---
schema_version: "1"
id: 55bc93a5a594e89c399bf3517de282d3413d438ae4164b6e92694034fb367c31
title: External OAuth for Snowflake
collection: tableau
version: current
locale: en-us
portal_url: https://docs.salesforce.com/tableau/current/en-us/server/snowflake_oauth_idp.md
canonical_url: https://help.tableau.com/current/server/en-us/snowflake_oauth_idp.htm
source_site: help.tableau.com
content_type: documentation
content_hash: ebb064d58190d460274d55baa14ebff3aaa0dc3bf1bdce8970e524246ab05e6d
description: Configure external OAuth to federate identity from an IdP to Snowflake.
---
[Skip to main content](#main-content)

# External OAuth for Snowflake

Starting in Tableau 2024.3, you can use OAuth 2.0/OIDC to federate identity from an external identity provider to Snowflake.

Depending on the identity provider, there are different steps needed to configure the integration. This is a high-level overview intended to guide your configuration without providing the necessary details you'll find in your identity provider documentation. It is assumed you are familiar with configuring OAuth and understand the technical details required in setting up authentication with an external identity provider.

## Configure IDP on Snowflake

For information on configuring your IDP, see [External OAuth overview](https://docs.snowflake.com/en/user-guide/oauth-ext-overview) in Snowflake's help system.

## Configure the IDP on Tableau

1. Create OAuth clients on the IDP for Tableau Desktop, and for Tableau Cloud or Tableau Server. The Desktop client enables [PKCE](https://auth0.com/docs/get-started/authentication-and-authorization-flow/authorization-code-flow-with-pkce) and uses `http://localhost` redirects.
2. Create the Tableau OAuth configuration file. For details on how to do this, see [OAuth Configuration and Usage](https://tableau.github.io/connector-plugin-sdk/docs/oauth) on [github](https://tableau.github.io/connector-plugin-sdk/docs/oauth), and examples [here](https://github.com/tableau/connector-plugin-sdk/tree/master/samples/components/oauth). We welcome additional examples for other IDPs.
    
    - Be sure to prefix the Tableau OAuth configuration IDs with “custom\_”.
        
        **Note:** OAuth config IDs have a maximum limit of 36 characters. IDs longer than this may not generate an error, but will not work.
    - If your IDP supports dynamic localhost port, disable `OAUTH_CAP_FIXED_PORT_IN_CALLBACK_URL`. If your IDP does not support this, make sure to add several localhost callback URLs to the allowlist in the configuration file and on the IDP.
3. Install the new Tableau OAuth configuration file in the OAuthConfigs folder associated with each application on desktop hosts (Tableau Desktop, Tableau Prep Builder, Tableau Bridge), and on each Tableau Server and Tableau Cloud site that will be using OAuth via site settings page. For more details, see [Custom OAuth Configs on Tableau Desktop](https://tableau.github.io/connector-plugin-sdk/docs/oauth#custom-oauth-configs-on-desktop) and [Site Level OAuth Clients](https://tableau.github.io/connector-plugin-sdk/docs/oauth#site-level-oauth-clients).

## Connect to Snowflake

When connecting, you must select OAuth and choose the OAuth configuration installed earlier.

![](/tableau/current/en-us/server/en-us/Img/snowflake_connect_oauth.png)

## Okta

If using Okta, it’s better to use a “custom authorization server” rather than the “org authorization server.” The custom authorization servers are more flexible. There’s a custom authorization server created by default, which is called “default”. The authorization URL should look like this:

`https://${yourOktaDomain}/oauth2/{authServerName}/v1/authorize`

![okta dashboard](/tableau/current/en-us/server/en-us/Img/athena_okta.png)