SNOW-3056678: Support for using `externalbrowser` auth from a remote machine

[jsnb-devoted]

Description

I know a lot of the Snowflake clients support this already and I'm trying to sort out how to use this in the terminal over ssh.

I would expect that the client could detect (or be instructed) to give the auth url and then wait, then have the user follow that url local, copy the redirect localhost url with the token and paste that into the waiting CLI.

Context

We want to use SSO with the snow cli but we strictly work on a remote machine over SSH

[sfc-gh-jwilkowski]

Hey @jsnb-devoted, have you tried that with newest version of CLI v3.15.0? In contains a fix for using auth with externalbrowser. We've been testing it on docker containers without browser, which as far as I understand is what you're looking for. CLI prints a url you need to copy to the browser and then copy back the redirect url. Could you check if that works for you?

[jsnb-devoted]

@sfc-gh-jwilkowski -- thanks for the tip. We are on 3.14.0 and I didn't realize there was a new version. I'll upgrade now and try it out.

[jsnb-devoted]

external browser auth works great but I'm having trouble getting the temporary credential to work. I have ALLOW_ID_TOKEN set to true on my account and I have tried using the --client-store-temporary-credential as well as setting that in my config. I've been looking for the ~/.cache/snowflake/temporary_credential.json file to show up but it never does. Feels like an issue on my end but not sure how extensively people are using browser auth with the temporary credential.

Once I do get that sorted out I've been asked by my infra team if the client supports hooking in to http://freedesktop.org/wiki/Specifications/secret-storage-spec/secrets-api-0.1.html
They are concerned with the credential being stored in plain text on disk.

[sfc-gh-jwilkowski]

external browser auth works great but I'm having trouble getting the temporary credential to work. I have ALLOW_ID_TOKEN set to true on my account and I have tried using the --client-store-temporary-credential as well as setting that in my config. I've been looking for the ~/.cache/snowflake/temporary_credential.json file to show up but it never does. Feels like an issue on my end but not sure how extensively people are using browser auth with the temporary credential.

I've tested this setup on one of my accounts, both with --client-store-temporary-credential and in config:

[connections.myconfig]
account = "..."
user = "..."
database = "..."
schema = "..."
warehouse = "..."
role = "..."
authenticator = "externalbrowser"
client_store_temporary_credential = true

and the caching worked for me. Only difference is that the file is called credential_cache_v1.json, see connector implementation. I'd recommend taking a look around TokenCache and FileTokenCache - those classes are quite talkative, so you might find out a lot in logs :)

Once I do get that sorted out I've been asked by my infra team if the client supports hooking in to http://freedesktop.org/wiki/Specifications/secret-storage-spec/secrets-api-0.1.html They are concerned with the credential being stored in plain text on disk.

From what I see on Windows and Macos we're using keyrings, and on linux we're saving tokens to restricted files, so I'm afraid the answer would be no. If that's an important feature for you, please create an issue for snowflake-python-connector

[jsnb-devoted]

HI @sfc-gh-jwilkowski -- I think I've sorted it out. I had to write a script to use the python client directly with externalbrowser auth. Using that script produced a warning that I didn't see in the snow cli with or without the --debug flag:

Warning: Cache directory validation failed for /home/jbrownstein/.cache/snowflake due to error 'Cache dir /home/xxxxxx/.cache/snowflake has incorrect permissions. 775 != 0700'. Skipping it in cache directory lookup.

There could be some logging config on my end that suppressed that for all I know but I would have expected to see that from the snow cli output especially with the debug flag.

Here is some output for a command where the temporary cred is valid:

└─❯ SF_TEMPORARY_CREDENTIAL_CACHE_DIR=~/.snowflake_cache snow sql -q "select 1" --debug                                                                                                                     
2026-02-12 19:17:41 DEBUG [snowflake.cli.api.sql_execution] Executing select 1                                                                                                                              
2026-02-12 19:17:41 DEBUG [snowflake.cli.api.sql_execution] Executing select 1                                                                                                                              2026-02-12 19:17:41 DEBUG [snowflake.connector.connection] cursor                                                                                                                                           
select 1                                                                                                                                                                                                    
2026-02-12 19:17:41 DEBUG [snowflake.connector.cursor] executing SQL/command                                                                                                                                
2026-02-12 19:17:41 DEBUG [snowflake.connector.cursor] query: [select 1]                                                                                                                                    
2026-02-12 19:17:41 DEBUG [snowflake.connector.cursor] binding: [select 1] with input=[None], processed=[{}]                                                                                                
2026-02-12 19:17:41 DEBUG [snowflake.connector.connection] sequence counter: 1                                                                                                                              
2026-02-12 19:17:41 DEBUG [snowflake.connector.cursor] Request id: 0162a96e-a139-44d7-959f-851268d505a1
2026-02-12 19:17:41 DEBUG [snowflake.connector.cursor] running query [select 1]                                                                                                                             
2026-02-12 19:17:41 DEBUG [snowflake.connector.cursor] is_file_transfer: False                                                                                                                              
2026-02-12 19:17:41 DEBUG [snowflake.connector.connection] _cmd_query
2026-02-12 19:17:41 DEBUG [snowflake.connector._query_context_cache] serialize_to_dict() called
2026-02-12 19:17:41 DEBUG [snowflake.connector.connection] sql=[select 1], sequence_id=[1], is_file_transfer=[False]

would you have expected to see a message here about it looking for the json file, finding it, skipping opening the browser etc?

[sfc-gh-jwilkowski]

Hi @jsnb-devoted definitely, something must be off with our logging. We'll try to take a deeper look at this issue and fix it. I'm glad that you were able to get down to it, so again thanks for reporting!