Snowflake programmatic access tokens

Connect Snowflake with a programmatic access token (PAT) and account host. The token belongs to one user; use ROLE_RESTRICTION to limit it to a role with the access your workflows need.

Sim stores the token alongside your account host as one credential. Once it is added, every Snowflake block picks it from a dropdown — and the block's database, schema, table, warehouse, role, file-format, and procedure fields become pickers that list what the token can actually see.

Prerequisites

• A Snowflake user you can generate a token for. For another user or a service user, your role needs OWNERSHIP or MODIFY PROGRAMMATIC AUTHENTICATION METHODS on that user.
• Your account host — the <account_identifier>.snowflakecomputing.com hostname, for example myorg-myaccount.snowflakecomputing.com. Snowsight shows it under Account details.
• A network policy covering the user, or an authentication policy that waives the requirement (see below).

Create the token

Option 1 — Snowsight

1. 1

   Open Governance & security → Users & roles and select the user the workflow should run as

2. 2

   Under Programmatic access tokens, click Generate new token

3. 3

   Give it a name, select a role restriction, and set the expiry in days. Snowsight requires a role for service users; person users can choose any of their roles unless policy requires a restriction

4. 4

   Copy the token secret. Snowflake shows it once, at creation

Option 2 — SQL

ALTER USER my_service_user ADD PROGRAMMATIC ACCESS TOKEN sim_workflows
  ROLE_RESTRICTION = 'SIM_WORKFLOW_ROLE'
  DAYS_TO_EXPIRY = 90;

Without an authentication-policy override, DAYS_TO_EXPIRY defaults to 15 days and cannot exceed 365. A PAT_POLICY can change the default with DEFAULT_EXPIRY_IN_DAYS or lower the ceiling with MAX_EXPIRY_IN_DAYS. A token can never be non-expiring, and the value cannot be changed after creation — to extend it, generate a new token and swap the credential in Sim. Plan the rotation when you create it.

Service users (TYPE = SERVICE, LEGACY_SERVICE, or SERVICE_AGENT) must set ROLE_RESTRICTION, unless an authentication policy exempts them. For person users it is optional but recommended: a restricted token can only ever act as that one role.

If an authentication policy applies to the user, 'PROGRAMMATIC_ACCESS_TOKEN' must appear in its AUTHENTICATION_METHODS list, otherwise the token is refused.

Add the credential to Sim

1. 1

   Add a Snowflake block to a workflow, open the credential dropdown, and choose to add a programmatic access token

2. 2

   Enter the account host (myorg-myaccount.snowflakecomputing.com) and paste the token

3. 3

   Save. Sim verifies the credential by running SELECT CURRENT_USER(), CURRENT_ACCOUNT(), CURRENT_ROLE() over the SQL API — a metadata-only statement that needs no running warehouse. A wrong host is reported separately. Authentication failures can also mean an expired token, a blocking network policy, or unavailable SQL API access.

The host and the token are encrypted before being stored, and the token is never returned to the browser — the block sends a credential id and Sim resolves it server-side.

Use the credential in workflows

Select the credential on any Snowflake block. You never enter the host again: every tool derives its endpoint from the host stored on the credential.

With a credential selected, these fields become pickers backed by metadata-only statements:

Pickers use the token's effective role: its restricted role when set, otherwise the user's default role. They do not apply the execution role selected on the block. An empty list can indicate a privilege gap. Switch any field to advanced mode to type a name directly or reference an upstream block's output instead.

Unload Data requires a table or view. To export a query result, create a view or use CREATE TABLE AS SELECT through Execute SQL, then unload that object.

Rotate or revoke tokens

A token's expiry is fixed at creation. To rotate, generate a new token on the same user and select Reconnect on the credential in Sim and paste the replacement — the old one stays valid until it expires, is disabled, or is removed. ALTER USER ... REMOVE PROGRAMMATIC ACCESS TOKEN <name> revokes immediately and cannot be undone.

Troubleshooting

See Snowflake's PAT requirements and limits. Metadata pickers and the credential check use warehouse-free statements; data queries and other operations can have separate Snowflake costs.