Skip to main content
Snowflake Cortex provides access to industry-leading large language models (LLMs) hosted directly within your Snowflake infrastructure. By connecting Cortex to Omni, you can power AI features without your data ever leaving the Snowflake security boundary. Because the LLMs are hosted within Snowflake, your metadata and query context remain governed by Snowflake’s existing security and compliance framework. Omni authenticates to Cortex with either a Snowflake key pair (recommended) or a Programmatic Access Token (PAT). A key pair doesn’t expire and, unless your Snowflake account is already restricted by a network policy, doesn’t require one.

​
Limitations

Currently, only Claude LLMs are supported for this integration. The Snowflake Cortex provider in Omni’s LLM settings lists the supported LLMs.

​
Requirements

To follow the steps in this guide, you’ll need:
  • Organization Admin permissions in Omni
  • In Snowflake, permissions that allow you to:
    • Grant roles to database users
    • Manage network policies. Required only needed for a PAT, or if your account is already restricted by a network policy.
    • Enable cross-region inference (for Claude model availability)
    • Authenticate with one of the following:
      • A Snowflake key pair (recommended). Omni can generate the key pair for you, or you can provide your own RSA key pair.
      • A Programmatic Access Token (PAT). This token serves as the Programmatic access token in your Omni configuration. See the Snowflake PAT documentation for how to create one.
      Snowflake is phasing out single-factor password authentication by October 2026. Use a key pair or a PAT for your Cortex API configuration to avoid future service interruptions.

​
Setting up Snowflake

Complete the following setup within your Snowflake instance before configuring Cortex in Omni.
1

Grant Cortex access

The Snowflake role used for your Omni connection must have the CORTEX_USER database role. Run the following to grant this role if the Omni user doesn’t currently have it:
2

Enable cross-region support

To ensure model availability (particularly for Claude models), enable cross-region inference. This allows Snowflake to route requests to regions where specific models are hosted:
3

Configure network policies

This section is required if either of the following are applicable:
  1. You’re authenticating with a PAT
  2. Your account is already restricted by a network policy
To permit the API traffic, allow Omni’s outbound IP addresses in your network policy. You can find these IPs on the Connection setup page in Omni, or in the IP Allowlist card on the Cortex provider settings page (LLM settings).After you retrieve Omni’s IP addresses, run the following, replacing <omni_ips> with the complete list of Omni’s IP addresses:

​
Enabling Snowflake Cortex as a provider

1
In Omni, navigate to AI Hub > General and click the LLM settings tab.
2
In the Providers section, click the Your API keys tab.
3
Click Snowflake Cortex to open its settings.
4
Select the tab for your authentication method to view instructions:
From the Authentication dropdown, select Key pair. Then add your connection details:
  • Base URL - Enter your Cortex API endpoint:
    To let Snowflake trace and attribute AI spend through its AI Gateway, you can instead enter the account’s AI Gateway URL. This requires USAGE granted to the Snowflake user on the gateway:
  • Snowflake user - Enter the Snowflake username Omni should authenticate as.
  • Key pair - Select how to provide the private key:
    1. Select Generate a key pair. Omni requests a 2048-bit RSA key pair from the server and displays its public key immediately. The private key isn’t stored until you save the form, so you can register the public key in Snowflake first without breaking your current configuration.
    2. Click Copy next to the public key.
    3. In Snowflake, register the key. If the Snowflake user doesn’t already have a key in the first slot, run:
      If that slot is already in use (for example, by the key an Omni connection signs in with), use the second slot instead:
    4. Click Save.
    Omni only supports unencrypted RSA private keys up to 4096 bits, in PKCS#8 or PKCS#1 PEM format. Omni converts a PKCS#1 key to PKCS#8 automatically. Omni refuses an encrypted key or a key over 4096 bits.
    1. Select Use my own private key and paste your private key. You can include or omit the -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY----- header lines.
    2. Omni derives and displays the matching public key. Click Copy next to it.
    3. In Snowflake, register the key. If the Snowflake user doesn’t already have a key in the first slot, run:
      If that slot is already in use (for example, by the key an Omni connection signs in with), use the second slot instead:
    4. Click Save.
Saving a new or generated key pair switches Cortex to it immediately. Every chat and AI feature that uses Cortex fails until the matching public key is registered in Snowflake.
Leaving the key field blank keeps the currently stored key, but only for the Base URL host it was saved under. If you point Cortex at a different account host, you need to paste the key again.
5
Click Save and approve.
6
To run AI features on Snowflake Cortex by default, select one of the models as the organization default.
By default, Omni approves all available LLMs once a provider is successfully configured, which means users can select the LLMs in the chat picker. Use the LLM section to revoke specific LLMs, mark an LLM as test only, and add useful descriptions.

​
Disabling Snowflake Cortex as a provider

In the Your API keys tab, use the toggle next to Snowflake Cortex to disable it as a provider. After Omni saves the changes, a Delete saved key option will display. Check this option and click Save to permanently delete the key. If you decide to re-enable Snowflake Cortex later, you’ll need to add a new API key.

​
Troubleshooting

  • Insufficient privileges: Ensure the role associated with your PAT or key pair has been granted the SNOWFLAKE.CORTEX_USER database role.
  • Region errors: If you receive errors regarding model availability, verify that CORTEX_ENABLED_CROSS_REGION is set to 'ANY_REGION'.
  • Network blocks: Double-check that all Omni egress IPs are included in your Snowflake Network Policy’s ALLOWED_IP_LIST.
  • AI features fail after saving a key pair: After you save a new or generated key pair, every chat and AI feature that uses Cortex fails until the matching public key is registered in Snowflake as RSA_PUBLIC_KEY (or RSA_PUBLIC_KEY_2, if that slot is already in use).
  • Chat shows a specific rejection reason: A rejected request now names the specific reason in the chat error (for example, a missing network policy or role grant) instead of a generic failure. Use that reason to identify which setup step to revisit.