Skip to main content

Bagel ↔ Snowflake Integration Guide

R
Written by Roy Turiski

Bagel connects to Snowflake to pull in data that powers its KPIs and customer segmentation — things like product usage, activity levels, risk scores, and other behavioral signals that live in your data warehouse rather than in your core CRM. This lets Bagel enrich standard CRM records (accounts, opportunities, etc.) with the deeper, more dynamic customer data Snowflake holds, so your KPIs and segments reflect a fuller picture of each customer.

Bagel strongly encourages connecting using Snowflake's key-pair (RSA) authentication over its API, which Snowflake recommends over basic username/password auth for programmatic, service-style connections like this one. Below is the full setup flow, covering what needs to happen on the Snowflake side and then on the Bagel side.

Part 1: Prepare Snowflake

  1. Create (or choose) a dedicated service user for Bagel. Using a dedicated user rather than a personal login makes it easier to manage permissions and rotate credentials later.

  2. Generate an RSA key pair. From a terminal, use OpenSSL to create a 2048-bit (minimum) private/public key pair. Snowflake supports both encrypted (passphrase-protected) and unencrypted private keys — an encrypted key with a strong passphrase is the safer option.

  3. Assign the public key to the Bagel service user. In Snowflake, this is done either with ALTER USER … ADD KEY PAIR (Snowflake's recommended approach, since it supports role restriction and expiration) or by setting the RSA_PUBLIC_KEY property via ALTER USER. You'll need OWNERSHIP or MODIFY PROGRAMMATIC AUTHENTICATION METHODS privilege on the user to do this.

  4. Retrieve the public key's SHA256 fingerprint. Snowflake can generate this for you with a DESC USER query; you'll need this value later in Bagel.

  5. Create or identify a role, warehouse, database, and schema for Bagel to use. Best practice is a role scoped to read-only access on just the schemas/views Bagel needs.

  6. Grant that role the necessary privileges (USAGE on the warehouse/database/schema, SELECT on the relevant tables/views) and grant the role to the Bagel service user.

  7. Note your account identifier. This is the organization-account (or organization-account.region) string Snowflake assigns your account — you can find it in Snowsight under your account details, or by running SELECT CURRENT_ORGANIZATION_NAME() || '-' || CURRENT_ACCOUNT_NAME();.

Part 2: Connect Bagel to Snowflake

  1. In Bagel, go to Settings → Integrations → Snowflake, and open the Authentication tab.

  2. Select API Key as the authentication method (as opposed to OAuth 2.0).

  3. Fill in the API Key Configuration fields:

    • Account Identifier — your Snowflake organization-account.region string from step 7 above.

    • Username — the Snowflake service user created for Bagel. (e.g. SRVC_BAGEL_AI_INTEGRATION_USER)

    • Private Key — the RSA private key generated for that user.

    • Public Key Fingerprint — the SHA256 fingerprint of the matching public key registered in Snowflake.

    • Private Key Passphrase — only required if you generated an encrypted private key.

  4. Click Test (or Test Again) to confirm Bagel can authenticate successfully. A successful test will show a "last tested" timestamp.

Alternative method: Connect via Snowflake OAuth 2.0

Please confirm first with the Bagel team!

This guide explains how to connect Bagel to Snowflake using OAuth 2.0 authentication. It covers creating a security integration in Snowflake and entering the resulting client credentials into Bagel.

Prerequisites
- Administrator access to your Snowflake account
- Ability to run SQL commands in a Snowflake worksheet

Step 1: Log Into Snowflake


Sign in to your Snowflake account using a user with administrator privileges. Administrator access is required to create a security integration.
​

Step 2: Create the Security Integration

In a Snowflake worksheet, run the following command to create an OAuth security integration named BAGEL:

CREATE SECURITY INTEGRATION BAGEL

TYPE = OAUTH

ENABLED = TRUE

OAUTH_CLIENT = CUSTOM

OAUTH_CLIENT_TYPE = ‘CONFIDENTIAL’

OAUTH_REDIRECT_URI = ‘https://app.bagel.ai/newIntegration’

OAUTH_ISSUE_REFRESH_TOKENS = TRUE

OAUTH_REFRESH_TOKEN_VALIDITY = 86400;
​

Step 3: Retrieve the Client ID and Secret


Next, run the command below to retrieve the OAuth client credentials for the integration:

SELECT SYSTEM$SHOW_OAUTH_CLIENT_SECRETS(‘BAGEL’);

The output is a JSON object with three fields: OAUTH_CLIENT_ID (your Client ID), OAUTH_CLIENT_SECRET (your primary Client Secret), and an optional OAUTH_CLIENT_SECRET_2, which is a rotated secret used only if key rotation is enabled.
​

Step 4: Enter Credentials in Bagel


In Bagel, open the Snowflake integration and go to the Authentication tab. Select OAuth 2.0 as the authentication method, then fill in:

  • Snowflake Account Identifier

  • Client ID - the OAUTH_CLIENT_ID value from Step 3

  • Client Secret - the OAUTH_CLIENT_SECRET value from Step 3

Click Save Credentials once these fields are filled in.

Snowflake OAuth Documentation
​

Step 5: Authorize the Connection


After saving the credentials, click Connect with Snowflake to complete the OAuth authorization and finish linking your Snowflake account to Bagel.

Additional Resources

Snowflake’s official OAuth documentation, linked from the setup instructions panel in Bagel, provides further background on configuring custom OAuth security integrations.

Related Articles
Did this answer your question?