Snowflake

Connect to Snowflake with password, key-pair, SSO, or OAuth auth

The account identifier is the whole address: myorg-myaccount, or the legacy locator xy12345.us-east-1, whatever sits in front of .snowflakecomputing.com. The form has no host or port field at all.

The Snowflake connection form with an account identifier

Quick setup

Click Create Connection…, select Snowflake, enter the Account Identifier, set Auth Method, and click Save & Connect. The form shows only the fields that method needs. Any account works: the driver speaks the same connector REST protocol as Snowflake’s own drivers, so there is no edition or version to match.

The driver is not in the app. Picking in the Choose a Database sheet offers the download before the form opens, and opening a saved connection installs it without asking. Settings > Plugins > Browse > installs it up front. See Plugins.

Connection settings

Field	Required	Notes
Account Identifier	Yes	myorg-myaccount or xy12345.us-east-1
Auth Method	Yes	Password, Key Pair, SSO (Browser), or OAuth Token
Username	Most	Password, key-pair, and SSO need it
Credentials	Per method	The form reveals what the method needs: Password with MFA Passcode (TOTP), Private Key File with Private Key Passphrase, or OAuth Token
Warehouse	No	Compute warehouse such as COMPUTE_WH
Database	No	Default database. Empty browses all of them
Schema	No	Default schema, PUBLIC if empty
Role	No	Session role, Advanced pane
CLI Connection Name	No	Section in ~/.snowflake/connections.toml, Advanced pane

Connection URL

Snowflake registers no URL scheme. The CLI config stands in for one: name a section in CLI Connection Name, and every field left empty is read at connect from ~/.snowflake/connections.toml, or a [connections.<name>] section of config.toml.

Authentication

Password

If the account enforces MFA, put a current code in MFA Passcode (TOTP); it expires in under a minute, so refresh it immediately before connecting. Running ALTER ACCOUNT SET ALLOW_CLIENT_MFA_CACHING = TRUE; as ACCOUNTADMIN ends that chore: connect once with a fresh code, and Snowflake returns an MFA token that TablePro keeps in the Keychain.

Key pair

Point Private Key File at an RSA private key in PKCS#8 (.p8) format, and add Private Key Passphrase for an encrypted key. Register the matching public key on the user first:

ALTER USER jane_doe SET RSA_PUBLIC_KEY='MIIBIjANBgkq…';

Every connect signs a one-hour JWT with that key, so the Mac’s clock has to be accurate.

Browser SSO

Sends you to your identity provider in the default browser and catches the reply on a loopback port, giving up after 2 minutes. With ALLOW_ID_TOKEN = TRUE on the account, Snowflake also returns a sign-in token; it goes to the Keychain, and later connects skip the browser until it is rejected.

OAuth token

Paste an access token issued for the account. Nothing refreshes it for you.

Browsing and sessions

The sidebar groups objects by database and schema. Object lists come from SHOW commands, which the metadata service answers with no warehouse running; column details come from INFORMATION_SCHEMA, which needs one.

Toolbar pickers move the session to another Warehouse or Role with USE WAREHOUSE and USE ROLE, no reconnect. A tab bound to a second database stays on that session too: USE DATABASE runs ahead of its statements. One TablePro connection is one Snowflake session, held open while idle by a heartbeat.

Editing

GET_DDL supplies the DDL view. Grid saves bind values server-side, VARIANT, OBJECT, and ARRAY cells through PARSE_JSON. The structure editor refuses a change Snowflake would reject before anything runs:

Change	Result
Add, rename, or drop a column	Runs
Widen a VARCHAR	Runs. Shrinking is refused
Change NUMBER precision	Runs at the same scale
Any other type change	Refused
NOT NULL, comment, primary key	Runs
Set a column default to a new value	Refused. Clearing one runs

SSL/TLS

No SSL/TLS pane, and no plaintext option. Every request is HTTPS to the account endpoint on port 443.

Limitations

• No SSH tunnel. The form has no SSH pane, and the endpoint is reached over HTTPS only.
• A grid edit keys on the declared primary key, or on every column when there is none, and a duplicate key value updates or deletes every row that matches it. Snowflake never enforces key constraints, so check a table for duplicates before editing it.

Troubleshooting

394508, MFA is required

The account enforces MFA on password logins. Enter a current code in MFA Passcode (TOTP), or move to key-pair or browser SSO, which never prompt.

394507, the passcode was rejected

The code was wrong or already expired. A rejected code is remembered and never resent, so open the connection settings and type a fresh one.

JWT token is invalid

Key-pair auth. The JWT issuer carries your account locator and a timestamp, so check the identifier and the Mac’s clock, then confirm the public key is registered on the user.

No databases in the sidebar

The connecting role needs USAGE on the databases. Set Warehouse too: column metadata runs on INFORMATION_SCHEMA, which needs one.

The browser never came back

Sign-in has 2 minutes, and the reply arrives on a loopback port. Allow the popup and retry.