Connect Snowflake to the Knowledge Base

With Snowflake, you can index tables and views from your Snowflake warehouse in the Knowledge Base, so your AI agents can answer questions grounded in that data.

Snowflake is connected through the Generic SQL tile on the Connections page. There is no separate Snowflake tile. This page covers the two supported sign-in methods and how to build the connection string for each.

Choose an authentication method

Method	Use it when	What you provide
Username and password	Your Snowflake user signs in with a password.	Username, password, account, database, schema, warehouse, role
Microsoft Entra ID (OAuth client credentials)	Your organization signs in to Snowflake through Entra ID and the connector should not use a per-user password.	Snowflake username, Entra app client ID and client secret, token URL, scope, account, database, schema, warehouse, role

Prerequisites

For username and password

• The Snowflake account identifier, database, schema, warehouse, and role for the connector user.
• The role must have usage on the warehouse, database, and schema, and read access to the tables you want to index.

For Microsoft Entra ID

• Your Snowflake administrator has configured Snowflake to trust your Entra ID tenant (an External OAuth security integration in Snowflake).
• An Entra ID app registration for the connector, with a client secret and the scope that Snowflake accepts.
• The Snowflake user name that the Entra ID token maps to. Snowflake checks that the username in the connection matches the identity in the token, so use the exact login name.

Connecting to Snowflake

1. Open Project Settings

   In your EKB project, navigate to Settings in the sidebar.

2. Go to Connections

   Select the Connections tab and find the Generic SQL tile under Databases.

3. Open the Generic SQL popup

   Click the Generic SQL tile, then click + Add Connection.

4. Fill in the connection form

   Server

   Field	Required	Description
   Connection Name	Yes	A display name for this connection (e.g. My Snowflake Connection).
   Connect String	Yes	The Snowflake connection string. See the formats below.

   Database

   Field	Required	Description
   Tables	Yes	The tables or views to index. Enter each name separated by a comma.

5. Save the connection

   Click Save. EKB validates the connection when you save. If validation fails, the error message tells you what to fix. When it succeeds, the Generic SQL tile shows a green dot and a count of active Generic SQL connections.

✓You're now ready to use your Snowflake data in the Knowledge Base!

Connect string formats

Username and password

snowflake://<username>:<password>@<account>/<database>/<schema>?warehouse=<warehouse>&role=<role>

Microsoft Entra ID (OAuth client credentials)

snowflake://<username>@<account>/<database>/<schema>?warehouse=<warehouse>&role=<role>&authenticator=oauth_client_credentials&oauth_client_id=<client-id>&oauth_client_secret=<client-secret>&oauth_token_request_url=https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/token&oauth_scope=api://<app-id>/.default

For Entra ID, the connection string does not include a password. The Entra ID token authenticates the connection.

Connect string parameters

Part	Required	Description
username	Yes	The Snowflake login name. For Entra ID, this must be the user that the token maps to.
password	Password only	The Snowflake password. Not used with Entra ID.
account	Yes	The account identifier, for example acmecorp1.us-east-1. You can paste the full host name (https://acmecorp1.us-east-1.snowflakecomputing.com). EKB removes the https:// prefix and the .snowflakecomputing.com suffix.
database / schema	Yes	The database and schema that contain the tables you want to index.
warehouse	Recommended	The warehouse used to run queries.
role	Recommended	The Snowflake role used for the session.
authenticator	Entra ID only	Must be oauth_client_credentials.
oauth_client_id	Entra ID only	The client (application) ID of your Entra ID app registration.
oauth_client_secret	Entra ID only	The client secret value of your Entra ID app registration.
oauth_token_request_url	Entra ID only	Your tenant's token endpoint: https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/token.
oauth_scope	Entra ID only	The scope Snowflake accepts, usually api://<app-id>/.default.
oauth_credentials_in_body	No	Set to true only if your identity provider requires the client credentials in the request body.

警告

If a value contains special characters, URL-encode it inside the connection string. For example, replace @ with %40, # with %23, & with %26, + with %2B, = with %3D, and / with %2F. Client secrets and passwords often contain these characters.

Rotating the Entra ID client secret

Entra ID client secrets expire. When you create a new secret, edit the Snowflake connection in the Generic SQL popup and update the oauth_client_secret value in the connect string. Save the connection again. The old secret stops working in Entra ID as soon as it is revoked or expires.

Troubleshooting

Missing OAuth parameters

Problem: Save fails with a message that OAuth parameters are missing, for example missing required query parameter(s).

Solutions:

1. Confirm the connect string includes all four Entra ID parameters: oauth_client_id, oauth_client_secret, oauth_token_request_url, and oauth_scope.
2. Confirm authenticator=oauth_client_credentials is present.

Account or host errors

Problem: Snowflake reports that the account must be specified, or the host cannot be reached.

Solutions:

1. Use the account identifier, such as acmecorp1.us-east-1, or the full host name. Do not add a path after the host.
2. Confirm the account identifier matches the Snowflake account in your URL.

Entra ID token or authentication errors

Problem: The connection fails when EKB requests a token from Entra ID.

Solutions:

1. Confirm the token URL uses your tenant ID and ends with /oauth2/v2.0/token.
2. Confirm the client ID and client secret belong to the same Entra ID app registration, and the secret has not expired.
3. Confirm the scope matches the audience that Snowflake accepts for your app registration.
4. Ask your Snowflake administrator to confirm the External OAuth security integration trusts your Entra ID tenant.

Username does not match the token

Problem: Snowflake rejects the connection even though the token is valid.

Solutions:

1. Use the exact Snowflake login name for the user that the token maps to. It is not the Entra ID display name.
2. Remember that the password field is not used with Entra ID. Leave it out of the connect string.

Permission errors or no tables indexed

Problem: The connection works, but tables are missing or queries fail.

Solutions:

1. Confirm the role has usage on the warehouse, database, and schema, and read access to the tables.
2. Confirm the table and view names in Tables match Snowflake exactly, including case, and that they exist in the schema in the connect string.

Related

• Generic SQL
• Connections