Authentication
Last updated
⌘Ctrlk
Snowflake authentication continues to work as normal. The proxy forwards authentication traffic to Snowflake without modifying it, so credentials are never inspected, stored, or altered. Snowflake performs all authentication exactly as it does without the proxy, and every authentication method it supports is unaffected by routing.
Username and password: Credentials pass through unchanged and are validated by Snowflake as usual.
Multi-factor authentication (MFA): MFA prompts and challenges are handled directly between you and Snowflake. The proxy does not interfere with the MFA flow.
Federated authentication & SSO: SAML/SSO redirects to your identity provider continue to work normally, since the proxy passes these requests through untouched.
Key-pair authentication: Signed JWTs are forwarded to Snowflake for verification. Your private keys never leave your environment and are never seen by the proxy.
Programmatic access tokens (PATs): Tokens are forwarded as-is and validated by Snowflake.
OAuth (Snowflake OAuth and External OAuth): OAuth token exchange and validation occur directly with Snowflake and your authorization server. The proxy does not modify tokens or intercept the OAuth flow.
Workload Identity Federation (WIF): Service-to-service identity tokens are passed through to Snowflake unchanged for verification.
If you use an IP allowlist, please let us know. Snowflake will see requests originating from the proxy's IP address, but we can mirror your allowlist on the proxy so requests are approved and rejected exactly per your existing policy.
Please add the following IPs to your allowlist for all users:
18.233.13.51
34.195.242.31
34.231.116.52
34.231.212.71
34.234.123.175
35.169.148.94
52.87.110.223
54.161.160.239Last updated