Create the credential in Snowflake
Create a dedicated Snowflake user for the agent with a read-only role scoped to the databases and schemas Claude should query. In Snowsight (Snowflake’s web interface), under Governance & security and then Users & roles, generate a programmatic access token for that user. Tokens expire after 15 days by default, so plan to rotate the credential. Snowflake’s guide for programmatic access tokens is at docs.snowflake.com. The connector authenticates with this token; key-pair authentication isn’t supported.Add the connector
Go to Organization settings > Claude Tag > Connectors, click Add, and select Snowflake. Fill in these fields in the connect form.
The first credential you add for a service from the Connectors tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see where a new connector applies before you save the connector. The Allowed websites field shows
*.snowflakecomputing.com only as a hint, and a wildcard under snowflakecomputing.com can’t be saved. Enter your account’s host there, then click Connect to save the connector.
To change the host later, go to Organization settings > Claude Tag > Connectors, click Snowflake, open the menu on the credential’s row in the Access from table, and click Edit. In the Edit connection dialog, the Allowed websites setting is labeled Allowed hosts. Change the host there and click Save.
The Agent Proxy injects the credential at the network boundary; the model and the sandbox are not given the key. See how Agent Proxy works.
Verify the connection
In a channel where the connector is on, in a new thread:Related resources
- What this connection adds: warehouse questions answered with charts in the thread
- Give Claude access: the full credential-type and allowed-hosts reference