Snowflake

Overview

Store a Snowflake programmatic access token (PAT) in Alter Vault and let agents run SQL over the Snowflake SQL API — without the token ever reaching agent code.

Property	Value
Provider ID	snowflake
Category	Database
Credential Type	Programmatic Access Token

Note

A programmatic access token is a long-lived static credential, so it stores cleanly in Alter Vault. Key-pair JWT and OAuth tokens are short-lived and are not used here.

Step 1: Get Credentials

Sign in to Snowsight

Sign in to Snowsight.

Check the network-policy requirement

A human user can generate a token without a network policy but cannot authenticate with it until governed by one; a service user needs a network policy to generate or use the token (service-agent users are exempt, and an authentication policy’s NETWORK_POLICY_EVALUATION setting can relax the rule).

Generate a programmatic access token

Follow Snowflake’s programmatic access-token guide. In Snowsight, go to Governance & security → Users & roles, select the user, open Programmatic access tokens, and click Generate new token — or in a worksheet, run:

ALTER USER my_user ADD PROGRAMMATIC ACCESS TOKEN agent_token
  ROLE_RESTRICTION = 'MY_ROLE'
  DAYS_TO_EXPIRY = 90;

Scope the token with ROLE_RESTRICTION so it carries only the privileges the integration needs. For service users (TYPE=SERVICE, SERVICE_AGENT, or LEGACY_SERVICE) Snowflake requires ROLE_RESTRICTION unless an authentication policy sets REQUIRE_ROLE_RESTRICTION_FOR_SERVICE_USERS to FALSE.

Copy the token secret

Copy the token secret (the token_secret column in the command output, or the value Snowsight displays) — it is shown only once.

Warning

The token grants access to the bound role’s data. Store it only in the Alter Vault Developer Portal, and rotate it before DAYS_TO_EXPIRY elapses.

Step 2: Add to Alter Vault

Open the Developer Portal

Go to portal.alterauth.com and navigate to the application.

Add Snowflake

Go to Managed Secrets > Add Provider > Snowflake.

Enter credentials

Paste the programmatic access token into the credential field.

Save

Click Save. You’ll receive a grant_id to use with the SDK.

Using in Code

Submit SQL to the account’s SQL API endpoint. The token is injected via the Authorization: Bearer header automatically.

response = await alter_app.request(
    HttpMethod.POST,
    "https://YOUR_ACCOUNT.snowflakecomputing.com/api/v2/statements",
    grant_id="YOUR_GRANT_ID",
    json={
        "statement": "SELECT id, name FROM customers WHERE region = ?",
        "bindings": {"1": {"type": "TEXT", "value": "EMEA"}},
        "warehouse": "MY_WH",
        "database": "MY_DB",
        "schema": "PUBLIC",
        "timeout": 60,
    },
)

Notes

• YOUR_ACCOUNT is the account identifier in the host (<account_identifier>.snowflakecomputing.com); the SQL API path is /api/v2/statements.
• The SQL API runs one statement per request (set MULTI_STATEMENT_COUNT for batches); interactive sessions require a driver and are not available over the REST API.
• Programmatic access tokens expire after DAYS_TO_EXPIRY (15 days by default) — rotate the stored credential before then. Authenticating with a token requires the user to be subject to a network policy (service-agent users are exempt) unless an authentication policy relaxes it.

Policy-cataloged operations

Alter policy rules can target these attested operations and families for operation-level and parameter-aware controls.

Operation ID	Families	Method	Provider path
SubmitStatement	admin, delete, read, write	POST	/api/v2/statements
GetStatementStatus	read	GET	/api/v2/statements/{statementHandle}
CancelStatement	write	POST	/api/v2/statements/{statementHandle}/cancel
createDatabase	write	POST	/api/v2/databases
deleteDatabase	delete	DELETE	/api/v2/databases/{name}
fetchDatabase	read	GET	/api/v2/databases/{name}
listDatabases	read	GET	/api/v2/databases
createSchema	write	POST	/api/v2/databases/{database}/schemas
listSchemas	read	GET	/api/v2/databases/{database}/schemas
createTable	write	POST	/api/v2/databases/{database}/schemas/{schema}/tables
listTables	read	GET	/api/v2/databases/{database}/schemas/{schema}/tables
createWarehouse	write	POST	/api/v2/warehouses
deleteWarehouse	delete	DELETE	/api/v2/warehouses/{name}
fetchWarehouse	read	GET	/api/v2/warehouses/{name}
listWarehouses	read	GET	/api/v2/warehouses
createUser	admin	POST	/api/v2/users
fetchUser	read	GET	/api/v2/users/{name}
listUsers	read	GET	/api/v2/users
createRole	admin	POST	/api/v2/roles
deleteRole	admin, delete	DELETE	/api/v2/roles/{name}
listRoles	read	GET	/api/v2/roles
listRoleGrants	read	GET	/api/v2/roles/{name}/grants
grantPrivilege	admin	POST	/api/v2/grants/{granteeType}/{granteeName}/{securableType}/{securableName}/privileges