OAuthClientCredentialsAuth

relationalai.config.connections.snowflake

Configure Snowflake access using the OAuth Client Credentials flow.

Use this authenticator for machine-to-machine workloads (long-lived server apps, scheduled jobs, etc.) where there is no interactive user to perform a browser-based OAuth flow. Snowflake’s connector handles token minting and re-minting from the configured oauth_client_id / oauth_client_secret on its own, so the session does not need to be restarted when tokens expire.

When loading from a config dict or file, set authenticator="oauth_client_credentials".

Instantiating this class is optional; you can also pass an equivalent dict to create_config.

Parameters

• account

  (str) - Snowflake account identifier.

• warehouse

  (str) - Snowflake warehouse name.

• oauth_client_id

  (str) - OAuth client id issued by the identity provider.

• oauth_client_secret

  (str or SecretStr) - OAuth client secret issued by the identity provider.

• oauth_token_request_url

  (str) - Identity provider’s OAuth token endpoint (where the client credentials are exchanged for an access token).

• oauth_scope

  (str) - OAuth scope. If omitted, Snowflake’s connector derives a default scope from role when one is set.

• oauth_credentials_in_body

  (bool) - Send the client_id/client_secret in the token request body instead of in the HTTP Basic Authorization header. Some identity providers (e.g. Auth0) require this. Only forwarded to Snowpark when set.

Examples

Create a programmatic config using this authenticator class:

from relationalai.config import Config, OAuthClientCredentialsAuth

cfg = Config(
    connections={
        "sf": OAuthClientCredentialsAuth(
            account="my_account",
            warehouse="my_warehouse",
            role="MY_ROLE",
            oauth_client_id="my_client_id",
            oauth_client_secret="my_client_secret",
            oauth_token_request_url="https://idp.example.com/oauth/token",
            oauth_scope="session:role:MY_ROLE",
        )
    }
)

Create a programmatic config using a plain dict (no authenticator import):

from relationalai.config import Config

cfg = Config(
    connections={
        "sf": {
            "type": "snowflake",
            "authenticator": "oauth_client_credentials",
            "account": "my_account",
            "warehouse": "my_warehouse",
            "role": "MY_ROLE",
            "oauth_client_id": "my_client_id",
            "oauth_client_secret": "my_client_secret",
            "oauth_token_request_url": "https://idp.example.com/oauth/token",
            "oauth_scope": "session:role:MY_ROLE",
        }
    }
)

Inheritance Hierarchy

Used By

 config > connections > snowflake
└──  SnowflakeAuthenticator