# Snowflake programmatic access tokens (/integrations/snowflake-service-account)

Connect Snowflake with a programmatic access token (PAT) and account host. The token belongs to one user; use `ROLE_RESTRICTION` to limit it to a role with the access your workflows need.

Sim stores the token alongside your account host as one credential. Once it is added, every Snowflake block picks it from a dropdown — and the block's database, schema, table, warehouse, role, file-format, and procedure fields become pickers that list what the token can actually see.

## Prerequisites \[#prerequisites]

- A Snowflake user you can generate a token for. For another user or a service user, your role needs `OWNERSHIP` or `MODIFY PROGRAMMATIC AUTHENTICATION METHODS` on that user.
- Your account host — the `<account_identifier>.snowflakecomputing.com` hostname, for example `myorg-myaccount.snowflakecomputing.com`. Snowsight shows it under **Account details**.
- A network policy covering the user, or an authentication policy that waives the requirement (see below).

Warning:

Snowflake's **network policy** requirement varies by user type, and getting it wrong is the most common reason a token is rejected:

- `TYPE = PERSON` — you can generate a token without a network policy, but the user **must** be covered by one to authenticate with it.
- `TYPE = SERVICE` and `TYPE = LEGACY_SERVICE` — a network policy is required to generate **and** to use a token.
- `TYPE = SERVICE_AGENT` — exempt; generate and use freely.

If your account has no network policy, either create one (allowing Sim's egress) or set `NETWORK_POLICY_EVALUATION = ENFORCED_NOT_REQUIRED` on an authentication policy applied to the user.

## Create the token \[#creating-the-token]

### Option 1 — Snowsight \[#option-1--snowsight]

Open **Governance & security** → **Users & roles** and select the user the workflow should run as

Under **Programmatic access tokens**, click **Generate new token**

Give it a name, select a role restriction, and set the expiry in days. Snowsight requires a role for service users; person users can choose any of their roles unless policy requires a restriction

Copy the token secret. Snowflake shows it **once**, at creation

### Option 2 — SQL \[#option-2--sql]

```sql
ALTER USER my_service_user ADD PROGRAMMATIC ACCESS TOKEN sim_workflows
  ROLE_RESTRICTION = 'SIM_WORKFLOW_ROLE'
  DAYS_TO_EXPIRY = 90;
```

Without an authentication-policy override, `DAYS_TO_EXPIRY` defaults to 15 days and cannot exceed 365. A `PAT_POLICY` can change the default with `DEFAULT_EXPIRY_IN_DAYS` or lower the ceiling with `MAX_EXPIRY_IN_DAYS`. **A token can never be non-expiring**, and the value cannot be changed after creation — to extend it, generate a new token and swap the credential in Sim. Plan the rotation when you create it.

Service users (`TYPE = SERVICE`, `LEGACY_SERVICE`, or `SERVICE_AGENT`) **must** set `ROLE_RESTRICTION`, unless an authentication policy exempts them. For person users it is optional but recommended: a restricted token can only ever act as that one role.

If an authentication policy applies to the user, `'PROGRAMMATIC_ACCESS_TOKEN'` must appear in its `AUTHENTICATION_METHODS` list, otherwise the token is refused.

## Add the credential to Sim \[#adding-the-credential-to-sim]

Add a **Snowflake** block to a workflow, open the credential dropdown, and choose to add a programmatic access token

Enter the **account host** (`myorg-myaccount.snowflakecomputing.com`) and paste the **token**

Save. Sim verifies the credential by running `SELECT CURRENT_USER(), CURRENT_ACCOUNT(), CURRENT_ROLE()` over the SQL API — a metadata-only statement that needs no running warehouse. A wrong host is reported separately. Authentication failures can also mean an expired token, a blocking network policy, or unavailable SQL API access.

The host and the token are encrypted before being stored, and the token is never returned to the browser — the block sends a credential id and Sim resolves it server-side.

## Use the credential in workflows \[#using-the-credential-in-workflows]

Select the credential on any Snowflake block. You never enter the host again: every tool derives its endpoint from the host stored on the credential.

With a credential selected, these fields become pickers backed by metadata-only statements:

| Field | Lists | Needs |
| - | - | - |
| Database | `SHOW DATABASES` | credential |
| Schema | `SHOW SCHEMAS IN DATABASE` | database |
| Table | `SHOW TABLES IN SCHEMA` | database, schema |
| Warehouse | `SHOW WAREHOUSES` | credential |
| Execution role | `CURRENT_AVAILABLE_ROLES()` | credential |
| Named file format | `SHOW FILE FORMATS IN SCHEMA` | database, schema |
| Procedure | `SHOW PROCEDURES IN SCHEMA` | database, schema |

Pickers use the token's effective role: its restricted role when set, otherwise the user's default role. They do not apply the execution role selected on the block. An empty list can indicate a privilege gap. Switch any field to advanced mode to type a name directly or reference an upstream block's output instead.

**Unload Data requires a table or view.** To export a query result, create a view or use `CREATE TABLE AS SELECT` through Execute SQL, then unload that object.

## Rotate or revoke tokens \[#rotating-and-revoking]

A token's expiry is fixed at creation. To rotate, generate a new token on the same user and select **Reconnect** on the credential in Sim and paste the replacement — the old one stays valid until it expires, is disabled, or is removed. `ALTER USER ... REMOVE PROGRAMMATIC ACCESS TOKEN <name>` revokes immediately and cannot be undone.

## Troubleshooting \[#troubleshooting]

| Problem | What to check |
| - | - |
| Lost token secret | Snowflake shows it only at creation. Generate a replacement and reconnect the credential in Sim. |
| Authentication fails | Check expiry or revocation, the user's network policy and Sim's egress, permitted authentication methods, role restriction, and SQL API access. |
| Wrong host | Use the account's Snowflake hostname. Sim reports a host error separately when the verification endpoint returns `404`. |
| Empty picker | Check privileges under the token's effective role. The block's execution role is not applied to metadata pickers; use advanced mode to enter a name when appropriate. |
| A second account is needed | Add another credential. Each token and stored host target one Snowflake account. |
| Token limit reached | Snowflake allows 15 unexpired PATs per user, including disabled tokens. Remove an unused token before creating another. |

See Snowflake's [PAT requirements and limits](https://docs.snowflake.com/en/user-guide/programmatic-access-tokens). Metadata pickers and the credential check use warehouse-free statements; data queries and other operations can have separate Snowflake costs.