# Atlas: Snowflake Cortex missing credentials (SNOWFLAKE_ACCOUNT, SNOWFLAKE_CORTEX_TOKEN) > Export SNOWFLAKE_ACCOUNT and SNOWFLAKE_CORTEX_TOKEN, or run `atlas auth login` for snowflake. A PAT or JWT works in the same bearer-token slot as OAuth. Atlas throws "Snowflake Cortex: missing credentials (SNOWFLAKE_ACCOUNT, SNOWFLAKE_CORTEX_TOKEN). Provide a bearer token (OAuth, JWT, or PAT) via env var, atlas auth, or provider options" because the Snowflake loader could not resolve an account, a bearer token, or both. The fix is to export SNOWFLAKE_ACCOUNT and a bearer token, or run atlas auth login for snowflake and complete the OAuth flow. A PAT or JWT works too, since the loader accepts any bearer token in the same slot. ## Symptom Selecting a Snowflake Cortex model throws: Snowflake Cortex: missing credentials (SNOWFLAKE_ACCOUNT, SNOWFLAKE_CORTEX_TOKEN). Provide a bearer token (OAuth, JWT, or PAT) via env var, atlas auth, or provider options. ## Cause The Snowflake loader in Atlas resolves a token from env, api key, OAuth access token, or provider options in that order, and an account from env or auth. When either is absent the provider does not autoload and getModel throws, listing exactly what is missing. ## Fix 1. Export SNOWFLAKE_ACCOUNT and a bearer token such as SNOWFLAKE_CORTEX_TOKEN in the shell that launches Atlas. 2. Or run `atlas auth login` for snowflake and complete the OAuth flow so Atlas stores the credentials for you. 3. A PAT or JWT works too. The Snowflake loader accepts any bearer token in the same slot as an OAuth access token. 4. If you use OAuth, note that a missing accountId raises: Snowflake OAuth auth is missing accountId. Supply the account id in the auth flow. 5. Restart Atlas and re-select the Snowflake Cortex model so the loader re-resolves the account and the token. ## Why does Atlas say Snowflake Cortex is missing credentials Atlas says "Snowflake Cortex: missing credentials (SNOWFLAKE_ACCOUNT, SNOWFLAKE_CORTEX_TOKEN)" because the Snowflake loader resolves a token from 4 sources in order, env, api key, OAuth access token, and provider options, and an account from env or auth. When either is absent, the provider does not autoload. Two things are required and they are resolved independently. The account tells Atlas which Snowflake account to address, and it comes from the environment or from auth. The bearer token authenticates, and the Snowflake loader searches four sources in a fixed order: env, api key, OAuth access token, and provider options. Missing either one means the Snowflake Cortex provider does not autoload, and getModel throws with a message that lists exactly what could not be found. Read that list literally. It names the credentials Atlas searched for and did not get. ## How to fix Snowflake Cortex missing credentials in Atlas Fix Snowflake Cortex missing credentials in Atlas by exporting SNOWFLAKE_ACCOUNT and a bearer token in the shell that launches Atlas, which covers both of the 2 requirements at once. The alternative is to run `atlas auth login` for snowflake and complete the OAuth flow, which stores the account and the access token. The env path is fast and explicit: SNOWFLAKE_ACCOUNT plus SNOWFLAKE_CORTEX_TOKEN, and the Snowflake loader picks both up on load. The auth path is better if you would rather not keep a Snowflake bearer token in shell config, since `atlas auth login` for snowflake runs the OAuth flow and persists the result. Both satisfy the same two requirements. Pick one and keep it as the single source of truth, because the loader searches several sources in order and a stale value in an earlier source will quietly win over the one you just set. ## Can I use a PAT or JWT instead of OAuth with Snowflake Cortex Yes. A PAT or JWT works with Snowflake Cortex in Atlas, because the Snowflake loader accepts any bearer token in the same slot. The error message names all 3 accepted forms: provide a bearer token (OAuth, JWT, or PAT) via env var, atlas auth, or provider options. Atlas is not opinionated about how the Snowflake bearer token was minted. A personal access token, a signed JWT, and an OAuth access token all land in the same slot in the Snowflake loader's resolution order, and any of them satisfies the token half of the requirement. That matters for teams whose Snowflake governance rules out an interactive OAuth flow on a developer machine. Supply the token you are permitted to use, pair it with SNOWFLAKE_ACCOUNT, and the Snowflake Cortex provider will autoload. ## Snowflake OAuth auth is missing accountId If you use OAuth with Snowflake Cortex in Atlas, a missing account id raises a distinct error: "Snowflake OAuth auth is missing accountId". The token resolved correctly in that case, so exactly 1 value is absent, the account id, and re-minting the bearer token will not clear the message. The two failures look similar and call for different actions. "Snowflake Cortex: missing credentials" means Atlas could not resolve the account, the token, or both. "Snowflake OAuth auth is missing accountId" is narrower: the OAuth flow produced an access token, but no account id came with it. Chasing the token when the account id is what is missing wastes a full auth cycle. Read the message, supply the account id in the snowflake auth flow or via SNOWFLAKE_ACCOUNT, and re-select the model. ## How to verify the Snowflake Cortex credentials fix worked Verify the Snowflake Cortex fix in Atlas by restarting Atlas and re-selecting the Snowflake Cortex model. The Snowflake loader resolves the account and searches its 4 token sources at load time, so a value exported after Atlas started, or in a different shell, will not be seen until you restart. Restart, re-select, and send a message. A completion with no "Snowflake Cortex: missing credentials" thrown from getModel confirms that the loader resolved both an account and a bearer token. If the message changes to "Snowflake OAuth auth is missing accountId", the token half is now satisfied and only the account id remains, which is a real step forward. Atlas lets you switch the active model and provider on the fly with favorites and recents, so re-selecting Snowflake Cortex after a restart takes one action. ## FAQ ### What credentials does Snowflake Cortex need in Atlas Snowflake Cortex needs an account and a bearer token. Export SNOWFLAKE_ACCOUNT and SNOWFLAKE_CORTEX_TOKEN, or run `atlas auth login` for snowflake and complete the OAuth flow. ### Can I use a Snowflake PAT with Atlas instead of OAuth Yes. A PAT or JWT works. The Snowflake loader in Atlas accepts any bearer token in the same slot, whether it came from OAuth, a JWT, or a personal access token. ### Where does Atlas look for the Snowflake token The Snowflake loader resolves a token from env, api key, OAuth access token, or provider options, in that order. It resolves the account from env or auth. ### What does Snowflake OAuth auth is missing accountId mean It means the OAuth flow produced an access token but no account id. Supply the account id through the snowflake auth flow or SNOWFLAKE_ACCOUNT. The bearer token itself is fine. ### Why does the Snowflake Cortex provider not load in Atlas When either the account or the bearer token is absent, the Snowflake Cortex provider does not autoload, and getModel throws listing exactly what is missing. ### I set SNOWFLAKE_ACCOUNT and Atlas still throws missing credentials Restart Atlas and re-select the model. The Snowflake loader resolves credentials at load time, so an export made after Atlas started, or in another shell, is invisible to it. Confirm a bearer token is also set. --- Canonical HTML: https://runatlas.sh/resources/troubleshooting/snowflake-cortex-missing-credentials Source of truth: aeo_pages row `/resources/troubleshooting/snowflake-cortex-missing-credentials` (segment: Troubleshooting) (this file is generated from it, never hand-edited). Licence: Atlas is proprietary with a free core. It is not open source and there is no public source repository.