OAuth Configuration

Snowflake Intelligence uses the user's active Snowflake session and does not require external OAuth setup.

Claude Code uses Snowflake OAuth to connect to the Snowflake-managed Metatate MCP server. Configure OAuth when you want users to run the Claude Code Plugin.

Role scope is required

Claude Code MCP registration must include session:role:<snowflake-role>. The same role must be allowed and preauthorized on the Snowflake OAuth security integration.

1. Choose the Claude roleDirect link to 1. Choose the Claude role

Use a least-privilege Snowflake role that can use Metatate. Do not use ACCOUNTADMIN, SECURITYADMIN, ORGADMIN, or other broad administration roles for daily Claude usage.

The examples below use:

METATATE_CLAUDE_USER

Grant the role to users:

GRANT ROLE METATATE_CLAUDE_USER TO USER <snowflake_user>;

Grant the Metatate application role required by your deployment:

GRANT APPLICATION ROLE METATATE_APP.APP_USER TO ROLE METATATE_CLAUDE_USER;

2. Create the OAuth security integrationDirect link to 2. Create the OAuth security integration

USE ROLE ACCOUNTADMIN;

CREATE SECURITY INTEGRATION METATATE_CLAUDE_CODE_OAUTH
  TYPE = OAUTH
  OAUTH_CLIENT = CUSTOM
  ENABLED = TRUE
  OAUTH_CLIENT_TYPE = 'CONFIDENTIAL'
  OAUTH_REDIRECT_URI = 'http://localhost:8080/callback'
  OAUTH_ALLOW_NON_TLS_REDIRECT_URI = TRUE
  OAUTH_ISSUE_REFRESH_TOKENS = TRUE;

Restrict the integration to the Claude role:

ALTER SECURITY INTEGRATION METATATE_CLAUDE_CODE_OAUTH
  SET ALLOWED_ROLES_LIST = ('METATATE_CLAUDE_USER')
      PRE_AUTHORIZED_ROLES_LIST = ('METATATE_CLAUDE_USER');

3. Delegate authorizationDirect link to 3. Delegate authorization

For each Snowflake user who will authenticate from Claude Code:

ALTER USER <snowflake_user>
  ADD DELEGATED AUTHORIZATION OF ROLE METATATE_CLAUDE_USER
  TO SECURITY INTEGRATION METATATE_CLAUDE_CODE_OAUTH;

If your account policy relies only on preauthorized roles, delegated authorization may not be required in every account. It remains a clear rollout pattern for a controlled user allowlist.

4. Retrieve client valuesDirect link to 4. Retrieve client values

SELECT SYSTEM$SHOW_OAUTH_CLIENT_SECRETS('METATATE_CLAUDE_CODE_OAUTH');

Share these values through your approved secret-sharing process:

Snowflake account URL
OAuth client ID
OAuth client secret
Snowflake role
App database, schema, and MCP server name if they differ from METATATE_APP.CORE.METATATE_MCP

Do not put the client secret in docs, tickets, screenshots, or committed files.

5. Register from Claude CodeDirect link to 5. Register from Claude Code

Users register the managed MCP server with:

claude mcp add-json --scope user --client-secret metatate '{
  "type": "http",
  "url": "https://<account-url>/api/v2/databases/METATATE_APP/schemas/CORE/mcp-servers/METATATE_MCP",
  "oauth": {
    "clientId": "<snowflake-oauth-client-id>",
    "callbackPort": 8080,
    "scopes": "session:role:METATATE_CLAUDE_USER"
  }
}'

The --client-secret metatate flag makes Claude Code prompt for the OAuth client secret instead of requiring it in the shell command.

Common failure: role ALL blockedDirect link to Common failure: role ALL blocked

If Snowflake shows:

The role ALL requested has been explicitly blocked for use with this application by an administrator.

the MCP registration is missing the role scope or is requesting a role that does not match the OAuth integration.

Fix:

Remove the old registration:
```
claude mcp remove metatate
```
Register again with session:role:<snowflake-role>.
Confirm the same role is present in ALLOWED_ROLES_LIST and PRE_AUTHORIZED_ROLES_LIST.

Users should not need to change their default Snowflake role to fix this.