Snowflake Connectors

The Snowflake connector is available exclusively on the Enterprise plan.

Warehouse Connectors let Replit Agent query your organization’s data warehouses. With the Snowflake connector, builders can create dashboards, reporting tools, and data applications using natural language — no SQL expertise required. Setup is a one-time process that requires a Snowflake admin and a Replit workspace admin. Once configured, any organization member can sign in and start building with Snowflake data. This guide walks you through the full setup. Three roles are involved:

Snowflake Account Admin — Creates the OAuth integration in Snowflake
Replit Workspace Admin — Configures the connector in Replit
Builder — Signs in and starts building

Create the OAuth integration in Snowflake

The Snowflake Account Admin creates an OAuth Security Integration that allows Replit to authenticate with Snowflake.

Prerequisites

ACCOUNTADMIN role in Snowflake
Access to run SQL in Snowflake worksheets

Run the setup script

Open your Snowflake account and make sure you are using the ACCOUNTADMIN role. You can verify this in the role dropdown in the top-right corner.

Open a SQL worksheet

Click Worksheets in the left sidebar and create a new worksheet.

Run the OAuth integration script

Copy and paste the following SQL script and run it:

Create OAuth integration

-- Drop existing integration if needed
DROP INTEGRATION IF EXISTS REPLIT_OAUTH;

-- Create OAuth integration for Replit
CREATE SECURITY INTEGRATION REPLIT_OAUTH
  TYPE = OAUTH
  ENABLED = TRUE
  OAUTH_CLIENT = CUSTOM
  OAUTH_CLIENT_TYPE = 'CONFIDENTIAL'
  OAUTH_REDIRECT_URI = 'https://replit.com/connectors/oauth/callback'
  OAUTH_ISSUE_REFRESH_TOKENS = TRUE
  OAUTH_REFRESH_TOKEN_VALIDITY = 7776000
  OAUTH_ALLOW_NON_TLS_REDIRECT_URI = FALSE
  BLOCKED_ROLES_LIST = ()
  COMMENT = 'OAuth integration for Replit connector';

The redirect URI must be exactly https://replit.com/connectors/oauth/callback. Any other value causes a 404 error during authentication.

Setting BLOCKED_ROLES_LIST = () ensures no roles are blocked from using the integration. Without this, you may get “invalid consent request” or “role blocked” errors when connecting.

Retrieve your OAuth credentials

Run this query to get the Client ID and Client Secret:

Get OAuth credentials

-- View integration details
DESCRIBE INTEGRATION REPLIT_OAUTH;

-- Get Client ID and Secret
WITH secrets AS (
  SELECT PARSE_JSON(
    SYSTEM$SHOW_OAUTH_CLIENT_SECRETS('REPLIT_OAUTH')
  ) as creds
)
SELECT
  creds:OAUTH_CLIENT_ID::STRING as CLIENT_ID,
  creds:OAUTH_CLIENT_SECRET::STRING as CLIENT_SECRET
FROM secrets;

Copy the Client ID and Client Secret from the output. You need these for the next step.

Allow connector traffic when network restrictions apply

If your Snowflake account restricts access by IP address, ask your Snowflake admin to check the network policy for REPLIT_OAUTH. Browser sign-in and connector requests follow different network policies:

Browser sign-in uses the Snowflake user’s network policy, or the account policy if no user policy exists.
Connector token requests and queries use the OAuth security integration’s network policy, or the account policy if no integration policy exists.

Successful browser sign-in does not confirm that Snowflake allows requests from the connector. Replit doesn’t publish a static IP list for connectors. Contact Replit support or your account team to get the current outbound IP addresses for the Snowflake connector before you update your allowlist. Have your Snowflake admin create or review a network policy that allows those addresses and meets your organization’s security requirements. To associate that policy with the existing OAuth integration, replace YOUR_CONNECTOR_NETWORK_POLICY with its name:

Set OAuth network policy

ALTER SECURITY INTEGRATION REPLIT_OAUTH
  SET NETWORK_POLICY = 'YOUR_CONNECTOR_NETWORK_POLICY';

An integration-level policy takes precedence over the account policy for these connector requests. Keep your account and user policies in place; do not disable network restrictions to troubleshoot. See Snowflake’s OAuth network policy guidance for details.

Configure the connector in Replit

The Replit Workspace Admin adds the Snowflake credentials to Replit. Once configured, anyone in the organization can sign in.

This step requires an Enterprise plan with admin access.

Open Integrations

Select your organization’s workspace, then go to Integrations in Settings.

Add the Snowflake connector

Click Add New Connector and select Snowflake.

Enter credentials

Provide the Client ID and Client Secret from the previous step.

Set the scope

Set the connector scope to refresh_token.

Only use the refresh_token scope. Other scopes like session:role-any or session:role:PUBLIC may cause an “invalid scope” error.

Save

Click Save to enable the connector.

Any organization member with access to the connector can sign in. Sign in from the Integrations page first to verify the connection before using it with Agent.

Find the Snowflake connector

Go to Integrations in Replit. Under Connectors, find Snowflake.

Click Sign In

Click Sign In on the Snowflake connector.

Enter your Snowflake Account ID

The OAuth prompt asks for your Snowflake Account ID.To find your Account ID, look at your Snowflake URL:

https://app.snowflake.com/myorg/myaccount

Take the two parts after app.snowflake.com/ and join them with a hyphen:

myorg-myaccount

The URL uses a / between the two parts, but the Account ID uses a - instead.

Authenticate

Snowflake redirects you to the login page. Enter your Snowflake credentials to complete the OAuth flow.

Start building with your Snowflake data

After connecting, you can use the Snowflake connector with Agent in two ways:

Slash command — Type /snowflake in the prompt to use the connector
Natural language — Ask Agent to use your Snowflake data directly

Here is an example prompt:

Build me a dashboard using my Snowflake data. Show total revenue
by region with a bar chart, a trend line by quarter, and a table
of top 10 customers. Dark theme, clean and modern.

Agent writes and executes SQL queries against your Snowflake data and builds a working application.

Troubleshooting

Your Snowflake integration may have roles blocked by default.Verify your integration was created with BLOCKED_ROLES_LIST = (). If you already created it without this setting, run:

Fix blocked roles

CREATE OR REPLACE SECURITY INTEGRATION REPLIT_OAUTH
  TYPE = OAUTH
  ENABLED = TRUE
  OAUTH_CLIENT = CUSTOM
  OAUTH_CLIENT_TYPE = 'CONFIDENTIAL'
  OAUTH_REDIRECT_URI = 'https://replit.com/connectors/oauth/callback'
  OAUTH_ISSUE_REFRESH_TOKENS = TRUE
  OAUTH_REFRESH_TOKEN_VALIDITY = 7776000
  OAUTH_ALLOW_NON_TLS_REDIRECT_URI = FALSE
  BLOCKED_ROLES_LIST = ()
  COMMENT = 'OAuth integration for Replit connector';

If the error persists, check that your default role is not blocked:

Set default role

ALTER USER "YOUR_USERNAME" SET DEFAULT_ROLE = 'PUBLIC';

404 error on authentication

Verify that the redirect URI in your Snowflake integration is exactly:

https://replit.com/connectors/oauth/callback

Any mismatch causes a 404 during the OAuth flow.

Invalid scope error

Make sure the connector scope in Replit is set to refresh_token only. Remove any other scopes like session:role-any or session:role:PUBLIC.

Failed to connect error

If browser sign-in succeeds but the connector fails to connect, network restrictions may still block the connector’s requests. Ask your Snowflake admin to check the policy on REPLIT_OAUTH, not only the user or account policy. Follow Allow connector traffic when network restrictions apply, then try signing in to the connector again.Verify that the Client ID and Client Secret in Replit match what Snowflake generated. Re-check by running:

Verify credentials

WITH secrets AS (
  SELECT PARSE_JSON(
    SYSTEM$SHOW_OAUTH_CLIENT_SECRETS('REPLIT_OAUTH')
  ) as creds
)
SELECT
  creds:OAUTH_CLIENT_ID::STRING as CLIENT_ID,
  creds:OAUTH_CLIENT_SECRET::STRING as CLIENT_SECRET
FROM secrets;

Warehouse connectors overview — Overview of all supported warehouse connectors
Connect Databricks — Step-by-step Databricks setup
Managing your connectors — Connector management and configuration
Snowflake — Configure OAuth for custom clients — Snowflake’s OAuth documentation

Overview

Workspace Essentials

Enterprise

Warehouse Connectors

Identity and Access Management

Billing for Enterprise

Snowflake Connectors

Create the OAuth integration in Snowflake

Prerequisites

Run the setup script

Allow connector traffic when network restrictions apply

Configure the connector in Replit

Start building with your Snowflake data

Troubleshooting

Create the OAuth integration in Snowflake

Prerequisites

Run the setup script

Allow connector traffic when network restrictions apply

Configure the connector in Replit

Sign in to Snowflake

Start building with your Snowflake data

Troubleshooting

Related documentation