Powering Claude Desktop with Cortex Inference

Introduction

Here’s two great things:

1. Cortex Inference: Snowflake’s governed API endpoints for LLM inference, using the models you already know and love, like Claude, and the tools and SDKs you already know and love, like the Anthropic Python SDK.
2. Claude Desktop: Anthropic’s desktop interface for Claude models, allowing you to use Claude Cowork or Claude Code without a terminal.

Now that Claude Desktop supports third-party inference providers, we can bring these two great things together and power Claude Desktop using Cortex Inference. This will allow you to use the tools you know and love with the Snowflake security you know and trust, all while consolidating your costs under a single platform.

In this article, we’ll cover two approaches for setting up Claude Desktop with Cortex Inference:

1. Using Programmatic Access Tokens, also known as PATs
2. Using Snowflake OAuth

So let’s get started with common setup between these two approaches.

Common Setup

Role: CORTEX_REST_API_ROLE

The CORTEX_REST_API_ROLE will be the role assigned to our users, allowing them to interact with Cortex Inference endpoints, like Anthropic messages. Below is the SQL you’ll execute in your Snowflake environment.

USE ROLE SECURITYADMIN;
CREATE ROLE IF NOT EXISTS CORTEX_REST_API_ROLE
  COMMENT = 'Minimum privileges to use the Snowflake Cortex REST API';
-- Core privilege: access to Cortex AI features via REST API
GRANT DATABASE ROLE SNOWFLAKE.CORTEX_REST_API_USER TO ROLE CORTEX_REST_API_ROLE;
-- Wire into role hierarchy so SYSADMIN can manage
GRANT ROLE CORTEX_REST_API_ROLE TO ROLE SYSADMIN;

Lastly, if you have any users you wish to grant this role to, now would be a good time to do so!

USE ROLE SECURITYADMIN;
GRANT ROLE CORTEX_REST_API_ROLE TO USER <user-name>;

Enable Developer Mode in Claude Desktop

If you haven’t already, enable Developer Mode in Claude Desktop, you can by navigating on the top bar to Help > Enable Developer Mode. Claude Desktop may restart at this point. You will be able to tell if you have Developer Mode enabled if you can see Developer in the top bar, as illustrated below.

Developer Mode enabled.

Developer Mode will be required to set up our third-party inference configuration.

Powering with PATs

We’ll use programmatic access tokens, or PATs, to power Claude Desktop with Snowflake inference in two steps:

1. Provisioning a PAT
2. Configuring Claude Desktop to use Cortex Inference with PATs

Provisioning a PAT

Users can provision their own PATs in the Snowsight UI following these directions from Snowflake Documentation. When creating a new PAT, users can scope the PAT to a single role, which is recommended, and in this case they would scope it to the CORTEX_REST_API_ROLEwe created above. An example of what the role scoping looks like is in the screenshot below.

An example of scoping a PAT to a single role.

Alternatively, if you are an administrator who wanted to manage PATs for a fleet of users directly, you can read about an approach to centralized PAT management here, or instead leverage the Snowflake OAuth approach, which requires no PATs, as described further down in this article.

Configuring Claude Desktop with PATs

With a role-scoped PAT in hand, we can use Claude Desktop’s developer mode to enable and configure third-party inference.

Now you can navigate to Developer > Configure Third Party Inference… and begin configuring third-party inference using Cortex Inference. Your settings, as illustrated in the image below, should be as follows:

• Connection: This specifies that we are configuring our own Gateway (Cortex Inference). We will select Gateway.
• Credential kind: This specifies the kind of credential we are going to use. We will specify Static API key, which is the appropriate selection to use our PAT.
• Gateway base URL: This specifies the LLM gateway’s URL we will use. It will include your account locator, and ultimately look something like: **https://<LOCATOR>.snowflakecomputing.com/api/v2/cortex/anthropic**
• Gateway API key: This specifies our credentials, in this case our PAT will go here.
• Gateway auth scheme: Snowflake Cortex Inference uses a bearer token approach for PATs, so we will select bearer here.

Please consult the image below to confirm you are configured correctly.

Example gateway settings using PAT.

Once you are done here, you have configured a PAT approach successfully. That said, Cortex Inference does not yet support automatic model discovery, so you will need to configure your model list. See the section Configuring Your Model List below. After setting that up, you can hit Apply Changes, and test your connection!

Powering with Snowflake OAuth

The Snowflake OAuth approach allows us to authenticate without having to manage a static key. Instead users authenticate through the browser. This is a more convenient approach for administrators, as there is no direct managing of keys.

To set up this approach, we will:

1. Create a Snowflake OAuth integration in our Snowflake account
2. Configuring Claude Desktop to use Cortex Inference with OAuth

Creating the OAuth Integration

First, we will create the integration. You can read more about the security integration below in our documentation here, but in short, we are creating a custom Snowflake OAuth integration that will allow our human users to authenticate to Snowflake in their browser, such that the tool they are using (Claude Desktop) will be allowed to use Cortex Inference. This OAuth integration can only use the CORTEX_REST_API_ROLE we created earlier, which is very limited in scope to only use Cortex Inference’s REST API.

We are then granting usage on this integration to the CORTEX_REST_API_ROLE. Below is the SQL you’ll execute in your Snowflake environment.

-- Create the OAuth integration
USE ROLE ACCOUNTADMIN;
CREATE OR REPLACE SECURITY INTEGRATION claude_desktop_oauth
      TYPE = OAUTH
      OAUTH_CLIENT = CUSTOM
      OAUTH_CLIENT_TYPE = 'PUBLIC'
      OAUTH_REDIRECT_URI = 'http://127.0.0.1:63353/callback'
      ALLOWED_ROLES_LIST=('CORTEX_REST_API_ROLE')
      OAUTH_USE_SECONDARY_ROLES = NONE
      OAUTH_ALLOW_NON_TLS_REDIRECT_URI = TRUE
      OAUTH_ENFORCE_PKCE = TRUE
      ENABLED = TRUE;

-- Allow CORTEX_REST_API_ROLE to use OAuth Integration
USE ROLE SECURITYADMIN;
GRANT USAGE ON INTEGRATION claude_desktop_oauth TO ROLE CORTEX_REST_API_ROLE;

Finally, we get our OAUTH_CLIENT_ID, OAUTH_AUTHORIZATION_ENDPOINT, and OAUTH_TOKEN_ENDPOINT from the SQL below, which we will input into Claude Desktop in our next step.

DESCRIBE INTEGRATION CLAUDE_DESKTOP_OAUTH;

Configuring Claude Desktop with Snowflake OAuth

With our OAuth configuration in hand, we can use Claude Desktop’s developer mode to enable and configure third-party inference.

Now you can navigate to Developer > Configure Third Party Inference… and begin configuring third-party inference using Cortex Inference. Your settings, as illustrated in the image below, should be as follows:

• Connection: This specifies that we are configuring our own Gateway (Cortex Inference). We will select Gateway.
• Credential kind: This specifies the kind of credential we are going to use. We will specify Interactive sign-in, which is the appropriate selection to use our Snowflake OAuth integration.
• Gateway base URL: This specifies the LLM gateway’s URL we will use. It will include your account locator, and ultimately look something like: **https://<LOCATOR>.snowflakecomputing.com/api/v2/cortex/anthropic**
• Client ID: This specifies the Snowflake OAuth client ID, which comes from the OAUTH_CLIENT_ID you retrieved above.
• Authorization URL: This specifies the Snowflake OAuth authorization URL, which comes from the OAUTH_AUTHORIZATION_ENDPOINT you retrieved above. It ends with /authorize.
• Token URL: This specifies the Snowflake OAuth authorization URL, which comes from the OAUTH_TOKEN_ENDPOINT you retrieved above. It ends with /token-request.
• Bearer token: This specifies which token to send as the gateway bearer. We will use Access token as the appropriate entry to OAuth resource servers.
• Scopes: This specifies the scope of our client’s requested access. In short, we will request to be authorized to utilize the privileges of our CORTEX_REST_API_ROLE (i.e. using the message API via Cortex Inference), as well as refresh the OAuth token without additional user intervention. For this, we will input refresh_token session:role:CORTEX_REST_API_ROLE. You can read more about the refresh_token scope here.
• Append offline_access: Toggle this off. The offline_access option is an alternative to the refresh_token scope we specified above. By default, Claude Desktop appends the offline_access scope to the OAuth authorization request. We don’t want that because Snowflake doesn’t accept offline_access.
• Redirect port: This specifies what port to specify the callback of the OAuth request. This must match the port of the OAUTH_REDIRECT_URI we set when creating the OAuth integration in Snowflake. You can set this to 63353.

You can consult the image below to check your configuration.

Example Snowflake OAuth configuration in Claude Desktop.

Once you are done here, you have configured the OAuth approach successfully. That said, Cortex Inference does not yet support automatic model discovery, so you will need to configure your model list. See the section Configuring Your Model List below. After setting that up, you can hit Apply Changes, and test your connection!

Configuring Your Model List

Regardless of whether you have configured with PAT or OAuth, Cortex Inference does not yet support automatic model discovery, so you will need to create a model list manually. In the same section you have been configuring your connection, if you scroll down you will see a Models section. Here, you can toggle off Model discovery and add individual models to the Model list. The example below shows the configuration of a model with the Model ID claude-opus-4-8 and the Display name Claude Opus 4.8. You can specify any Claude model you would like here, and you can see the full list of available models in Cortex Inference here.

Configuring a model list manually for Cortex Inference in Claude Desktop

Once you have configured your model list, you can click Apply Changes and test out Claude Desktop, powered by Cortex Inference!

Conclusion

In this post, we have seen two ways to power Claude Desktop with Cortex Inference:

1. Using Programmatic Access Tokens, also known as PATs
2. Using Snowflake OAuth

This allows you to use the tools you know and love with the Snowflake security you know and trust, all while consolidating your costs under a single platform. May you go off now and build something great!