How v0 authenticates to Snowflake without exposing the user's OAuth token
Vercel’s v0 integration with Snowflake authenticates generated code without exposing user OAuth tokens by routing requests through a server-side proxy that injects credentials at request time.
Vercel’s v0 Snowflake integration enables AI-generated applications to connect to Snowflake warehouses, query data, and build applications without requiring direct access to the user’s OAuth token. The generated code runs in isolated sandboxes, which prevent untrusted code from accessing system resources but cannot protect secrets once they are present inside the sandbox. To address this, Vercel implemented a Snowflake request proxy that resolves credentials server-side, outside the sandbox runtime, ensuring the OAuth token never enters the sandbox environment.
The proxy intercepts requests from the sandbox, verifies the sandbox’s identity via an OIDC token, and retrieves a fresh Snowflake credential bound to the user’s session. It then rewrites the request to include the credential in the appropriate field, depending on the Snowflake request type. For SQL API requests, the credential is injected into the Authorization header, while login requests receive the token in the request body. Session tokens, issued by Snowflake after login, are short-lived and confined to the sandbox, reducing exposure risks.
To maintain compatibility with existing Snowflake clients, the sandbox includes a placeholder token—a fixed, public string that triggers the client’s authentication flow without granting access. The proxy never authorizes requests based on this placeholder; instead, it relies on the sandbox’s server-side identity and user session binding. This approach ensures that generated code can interact with Snowflake without ever handling the user’s OAuth token directly.
The proxy also enforces strict request validation to prevent credential leakage. It rejects requests where the placeholder appears in caller-controlled data, such as SQL queries, and logs misuse events for observability. By structuring authentication injection based on Snowflake’s request formats and bounding request inspection, Vercel mitigates risks of prompt injection or accidental exposure while preserving compatibility with existing Snowflake workflows.