Connections are added inside an Access bundle. At
claude.ai/admin-settings/claude-tag, open Access bundles in the left navigation, click into a bundle (or Create one), and go to its Credentials tab.Create the credential in Snowflake
Create a dedicated Snowflake user for the agent with a read-only role scoped to the databases and schemas Claude should query. Generate a programmatic access token for that user. Snowflake’s guide for the SQL REST API and authentication is at docs.snowflake.com.Add the connection to a bundle
In the bundle, click Connect another app at the bottom and choose Bearer. Bearer is the only supported credential type for Snowflake; key-pair authentication is not currently supported.| Field | Value |
|---|---|
| Credential type | Bearer |
| Custom headers | Add a row with Name Authorization, Prefix Bearer , and Value set to the programmatic access token from Snowflake |
| Allowed websites | <your-account>.snowflakecomputing.com |
<your-account> with your Snowflake account identifier. To change the host later, open the ⋮ menu on this connection in the bundle’s Credentials tab and choose Edit.
The Agent Proxy injects the credential at the network boundary; the model and the sandbox are not given the key. See how Agent Proxy works.
Verify the connection
In a channel under the bundle’s scope, in a new thread:Related resources
- What this connection adds: warehouse questions answered with charts in the thread
- Give Claude access: the full credential-type and allowed-hosts reference