mirror of
https://github.com/langgenius/dify-official-plugins.git
synced 2026-07-21 17:45:23 -04:00
Snowflake OAuth2 integration failure - snowflake_sql plugin #837
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @HABE-WAKAM on GitHub (Nov 26, 2025).
Self Checks
Dify version
1.9.1
Plugin version
0.0.1
Cloud or Self Hosted
Self Hosted (Docker)
Steps to reproduce
Add snowflake_sql integration into dify
Create the OAuth integration on Snowflake following the documentation
Install the plugin
Follow the plugin documentation to configure the connection using the right uri. We used the indicated callback uri in the plugin integration : /console/api/oauth/plugin/langgenius/snowflake_sql/snowflake_sql/tool/callback
✔️ Error log
@dosubot[bot] commented on GitHub (Nov 26, 2025):
Hi @HABE-WAKAM! I'm Dosu and I’m helping the dify-official-plugins team.
The redirect URI mismatch error happens when the URI used in the OAuth flow does not exactly match what you registered in your Snowflake OAuth integration. Dify constructs the redirect URI dynamically using your configured base URL (protocol, domain, port) plus the path
/console/api/oauth/plugin/langgenius/snowflake_sql/snowflake_sql/tool/callback— this must be an exact match, including protocol (httpvshttps), domain, port, and any trailing slashes, with what you registered in Snowflake’s OAuth client settings. Even a small difference (like a missing port or usinglocalhostvs a public domain) will cause this error.To resolve this:
https://mydify.example.com, the redirect URI should be:The plugin and backend do not modify or normalize the redirect URI, so it must be an exact string match between Dify and Snowflake for OAuth to succeed. You can see how Dify constructs this URI in the backend code and plugin logic — it always uses the base URL plus the callback path, and passes this directly to Snowflake during the OAuth flow (reference, reference).
If you update the registered redirect URI in Snowflake to match exactly what Dify is using, the OAuth2 integration should work.
To reply, just mention @dosu.
How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other
@HABE-WAKAM commented on GitHub (Dec 3, 2025):
@dosu
I have checked the URI and its the good one.
When I try to open the callback URI on my browser I have a 403 error.
{"code":"forbidden","message":"context_id not found","status":403}
@dosubot[bot] commented on GitHub (Dec 3, 2025):
The 403 error with "context_id not found" happens because the OAuth2 callback endpoint expects a special context (a context_id cookie) that Dify sets when you start the OAuth flow from within the Dify UI. If you open the callback URI directly in your browser, that context is missing, so the endpoint always returns this error.
To complete the OAuth2 flow, you need to initiate the Snowflake integration from Dify itself (not by manually visiting the callback URL). Dify will redirect you to Snowflake for authorization, then Snowflake will redirect you back to the callback URI with all the required context and parameters. This is a security measure to prevent unauthorized access and CSRF attacks.
If you follow the flow from the Dify UI and still get errors, double-check that your redirect URI matches exactly in both Dify and Snowflake, and make sure your browser allows cookies for your Dify domain. If you still have trouble after following the correct flow, let me know what step fails and what error you see.
You can see the relevant logic in the Dify backend here:
OAuth callback expects context_id cookie and validates it
OAuth proxy context creation and validation
To reply, just mention @dosu.
How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other