# Snowflake Authentication

Set `--authenticator` (or `authenticator` in `connections.toml`, or in a Harlequin profile) to any of the values the Snowflake connector supports:

| Authenticator               | What it needs                                                                                                                                                  |
| --------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `snowflake` (default)       | `--user` and `--password`                                                                                                                                      |
| `externalbrowser`           | `--user`; opens a browser for SSO. Add `--client-store-temporary-credential` so it does not open one every time.                                               |
| `snowflake_jwt` (key pair)  | `--user` and `--private-key-file` (plus `--private-key-file-pwd` if the key is encrypted). Passing `--private-key-file` selects this authenticator on its own. |
| `oauth`                     | `--token`, or `--token-file-path`                                                                                                                              |
| `oauth_authorization_code`  | `--oauth-client-id`, `--oauth-client-secret`, and optionally the URL options                                                                                   |
| `oauth_client_credentials`  | `--oauth-client-id`, `--oauth-client-secret`, and `--oauth-token-request-url`                                                                                  |
| `programmatic_access_token` | `--user` and the PAT in `--token`                                                                                                                              |
| `username_password_mfa`     | `--user`, `--password`, and `--passcode` (or `--passcode-in-password`). Add `--client-request-mfa-token` to cache the token.                                   |
| `workload_identity`         | `--workload-identity-provider` (`AWS`, `AZURE`, `GCP`, or `OIDC`)                                                                                              |
| `https://myorg.okta.com`    | `--user` and `--password`, for native Okta                                                                                                                     |

## Secrets

The `--password`, `--token`, `--passcode`, `--private-key-file-pwd`, `--oauth-client-secret`, and `--proxy-password` options are marked as secrets, so Harlequin never prints them back.

## Read-Only Mode

> **Note:** Snowflake has no server-enforced read-only session or transaction, so this adapter does not offer Harlequin's `--read-only` option: it would be a promise it could not keep. Connect with a role that only has the privileges you want instead.