How v0 authenticates to Snowflake without exposing the user's OAuth token
By Steven Van ·
AI-generated applications often need to authenticate to external services on behalf of their users.
Vercel has published details on how its v0 Snowflake integration keeps AI-generated code from ever touching a user's real Snowflake credential. The integration lets v0 users connect Snowflake, inspect schemas, query data, and generate applications that run against their warehouses, but that generated code is written by a model, runs without human review, and can be steered by prompt injection into exfiltrating anything it can read, so the user's OAuth token is never allowed into the sandbox where the code executes.
The fix, described in the announcement, is a Snowflake request proxy built on the Vercel Sandbox firewall. Every Snowflake request from a sandbox is forwarded to a proxy running outside the sandbox runtime, which verifies the sandbox's OIDC token, looks up the v0 chat it belongs to, restores the bound user session, and fetches a fresh Snowflake credential for that request. To keep existing Snowflake SDK and CLI flows working without a real token present, the sandbox is given a fixed, public, 72-byte placeholder string instead: it grants no access on its own, and the proxy authorizes requests using the sandbox's identity, not the placeholder.
The team's first version of the proxy blindly replaced the placeholder with the real token wherever it appeared in a request, which turned out to be unsafe: if generated code put the placeholder inside a SQL string literal, the swap would inject the real OAuth token into the query, and a returned result could leak it back into the sandbox. The current proxy instead injects the credential only into known authentication fields, an Authorization: Bearer header for Snowflake SQL API calls or the login token field for login requests, and fails closed: it rejects requests where the sandbox isn't bound to a chat, no credential can be obtained, the account host can't be derived, the placeholder shows up outside an approved field, or a login body can't be parsed safely.
