Connecting Snowflake to Ejento

This guide is for the Snowflake administrator at your organization. It lets Ejento query your Snowflake data on behalf of your users.

When you finish, you'll send Ejento a short list of values (see What to send us). We complete the setup on our side, and each of your users can then connect their own Snowflake account from inside Ejento.

Time required: about 30 minutes.

Requirements

Requirement	Details
Snowflake account	Any commercial Snowflake account. An Enterprise edition is not required for the connection itself.
Administrator access	Someone who can use the `ACCOUNTADMIN` role, or a role with privileges to create roles, MCP servers and security integrations.
A warehouse	An existing warehouse to run queries. We suggest a small, dedicated one so you can track and cap cost.
Network access	If your account uses a network policy, your users' networks must be allowed to sign in.
Optional: Cortex features	If you want Cortex Analyst or Cortex Search tools, your account must have those features available in its region.

How it works

Ejento connects to a Snowflake-managed MCP server in your account. Snowflake hosts it, so you deploy nothing.

Each user signs in with their own Snowflake login (OAuth). Ejento never sees their password.

Every query runs as that user, under a dedicated role you control. Ejento can only see what that role can see.

You can revoke access at any time by disabling the integration or the role.

Before you start

Ejento will send you a redirect URI that looks like this:

https://<EJENTO_AUTH_DOMAIN>/api/v2/mcp-sso/snowflake/callback

Use it exactly as given, character for character. Any difference causes a "redirect URI mismatch" error at sign-in.

Also decide:

Which data Ejento may access: the databases, schemas or tables.

Which warehouse runs the queries.

Which users should be able to connect.

Step 1: Open a SQL worksheet

Switch your role to ACCOUNTADMIN in the account menu at the bottom left.

Create a new SQL worksheet.

Step 2: Create a dedicated role

This role controls everything Ejento can see. Grant it only what is needed.

Important: You can't use ACCOUNTADMIN, SECURITYADMIN or ORGADMIN. Snowflake blocks these admin roles for OAuth sign-ins.

Replace every <PLACEHOLDER> with your own values, then run:

Step 3: Create the MCP server

The MCP server is the endpoint Ejento calls. This example exposes one read-only SQL tool.

To add Cortex Analyst (semantic views) or Cortex Search tools, contact us and we'll help with the specification.

Step 4: Register Ejento as an OAuth client

This lets your users sign in to Snowflake from Ejento. Replace <REDIRECT_URI> with the exact URI Ejento sent you.

Step 5: Get the client ID and secret

Click the result cell to see the full value:

{"OAUTH_CLIENT_SECRET_2":"...","OAUTH_CLIENT_SECRET":"...","OAUTH_CLIENT_ID":"..."}

You only need OAUTH_CLIENT_ID and OAUTH_CLIENT_SECRET. OAUTH_CLIENT_SECRET_2 is a backup Snowflake keeps for rotation, so you don't need to send it.

Check the integration name. If your account has other OAuth integrations, make sure you ran this for the one you just created. A client ID from a different integration causes a "redirect URI mismatch" error.

Step 6: Find your account identifier

In Snowsight, open the account menu at the bottom left, then Account → View account details, and copy the Account identifier. It looks like <ORG_NAME>-<ACCOUNT_NAME>.

If your account name contains underscores, tell us. The MCP server hostname needs hyphens in place of underscores.

What to send us

Send these values to your Ejento contact through a secure channel, such as a password manager share or an encrypted message. Don't use plain email or chat.

Value	Where it comes from
Account identifier	Step 6
OAuth client ID	Step 5 (`OAUTH_CLIENT_ID`)
OAuth client secret	Step 5 (`OAUTH_CLIENT_SECRET`)
Role name	Step 2 (`<MCP_ROLE>`)
MCP server name	Step 3 (`<MCP_DATABASE>.<MCP_SCHEMA>.<MCP_SERVER_NAME>`)

That's everything on your side. We'll confirm once the connection is configured.

After setup: how your users connect

In Ejento, go to the integrations page and click Connect Snowflake.

They're sent back to Ejento with a "Snowflake connected successfully" message.

A user only needs to reconnect if their session is revoked or unused longer than the refresh-token lifetime, which is 90 days by default.

Managing access

To...	Run
Let another user connect	`GRANT ROLE <MCP_ROLE> TO USER <USERNAME>;`
Remove one user's access	`REVOKE ROLE <MCP_ROLE> FROM USER <USERNAME>;`
Share more data with Ejento	`GRANT SELECT ON ... TO ROLE <MCP_ROLE>;`
Temporarily disable Ejento for everyone	`ALTER SECURITY INTEGRATION <INTEGRATION_NAME> SET ENABLED = FALSE;`
Rotate the client secret	`ALTER SECURITY INTEGRATION <INTEGRATION_NAME> REFRESH OAUTH_CLIENT_SECRET;`, then send us the new secret

Troubleshooting

Error	Cause	Fix
Redirect URI mismatch	The redirect URI isn't exactly the one Ejento sent, or the client ID belongs to a different integration.	Run `DESC SECURITY INTEGRATION <INTEGRATION_NAME>;` and check `OAUTH_REDIRECT_URI` and `OAUTH_CLIENT_ID`.
Role ... has been explicitly blocked	An admin role is in use, or secondary roles are enabled.	Use the dedicated role (Step 2) and keep `OAUTH_USE_SECONDARY_ROLES = NONE`.
User is not granted role	The person signing in doesn't have `<MCP_ROLE>`.	`GRANT ROLE <MCP_ROLE> TO USER <USERNAME>;`
Insufficient privileges when a query runs	The role can't read the table or use the warehouse.	Grant the missing `USAGE`/`SELECT` privileges to `<MCP_ROLE>`.
Connection or hostname errors	The account hostname contains underscores.	Use the hyphenated form of the account identifier.
Sign-in blocked by network policy	Your account restricts sign-in by IP address.	Make sure your users' networks are allowed. Contact us if you need Ejento's outbound IP addresses.

Snowflake

Connecting Snowflake to Ejento#

Requirements#

How it works#

Before you start#

Step 1: Open a SQL worksheet#

Step 2: Create a dedicated role#

Step 3: Create the MCP server#

Step 4: Register Ejento as an OAuth client#

Step 5: Get the client ID and secret#

Step 6: Find your account identifier#

What to send us#

After setup: how your users connect#

Managing access#

Troubleshooting#