Connections, Roles, and Warehouses: Getting CoCo Desktop Production-Ready from Day One

Last Updated on June 8, 2026 by Editorial Team Author(s): Satish Kumar Originally published on Towards AI. Connections, Roles, and Warehouses: Getting CoCo Desktop Production-Ready from Day One Snowflake COCO Desktop| Part 1 of 8 There’s a moment every data engineer hits when first opening Snowflake’s CoCo Desktop: the welcome screen looks clean, the interface is polished, and then the connect step appears. And if your organization uses SSO, has multiple accounts, or runs a non-default role setup — that step is where things quietly fall apart. Most getting-started content for AI coding tools assumes the connection is the easy part. With CoCo Desktop, authentication is where you make architectural decisions that affect every subsequent session: which credentials get cached, which warehouse runs agent queries, which role the agent operates under. Getting it right upfront saves a lot of friction later. Getting it wrong means your agents either fail silently or run with more privileges than you intended. This is the first article in an 8-part series on Snowflake CoCo Desktop for data engineering teams. This one covers everything before the first prompt: installation, prerequisites, the onboarding flow, authentication options, connection management, and the decisions you’ll want to make consciously rather than by default. TL;DR CoCo Desktop requires a paid Snowflake account with Cortex Code enabled and the SNOWFLAKE.CORTEX_USERdatabase role — trial accounts won't work. Available for macOS and Windows only (no Linux desktop client). The 4-step onboarding flow (welcome → connect → mode → theme) is mostly intuitive, but the Connect step catches teams who rely on SSO without a configured default browser. OAuth is the right default for most users. Password auth is available but not recommended; key pair is best for service accounts. PAT and Workload Identity Federation are also supported for specialized use cases. Default Warehouse set via the UI persists both server-side on your Snowflake account and locally in connections.toml. That dual-write behavior matters when multiple team members share the same Snowflake user. The connections.toml file permissions (chmod 600) are a requirement on macOS/Linux, not just a best practice — Snowflake tools will refuse to read the file otherwise. What this doesn’t cover: how to configure roles for least-privilege agent use — that’s a permission modes topic covered in subsequent Article. Prerequisites: What You Need Before Installing Before downloading CoCo Desktop, confirm these requirements are met. Skipping this step is the most common source of “it connects but nothing works” issues. Account requirements: A paid Snowflake account (trial accounts are explicitly blocked — see the troubleshooting section below) Cortex Code must be enabled on the account Your user must have the SNOWFLAKE.CORTEX_USER database role (granted through PUBLIC by default, but your org may have revoked it) At least one supported model must be available to your account (check CORTEX_MODELS_ALLOWLIST) Platform requirements: macOS (Apple Silicon or Intel) or Windows Linux is not supported for the desktop client (use Cortex Code CLI instead) Network requirements: Network access to your Snowflake server If a model you need isn’t available in your region, an ACCOUNTADMIN must configure cross-region inference: ALTER ACCOUNT SET CORTEX_ENABLED_CROSS_REGION = 'AWS_US'; Replace AWS_US with the appropriate region identifier (AWS_EU, AWS_APJ, AZURE_US, or ANY_REGION). This is a common first-run blocker that looks like a connection failure but is actually a model availability issue. Quick prerequisite check — run this in any Snowflake worksheet to confirm readiness: SELECT CURRENT_USER() AS user, CURRENT_ROLE() AS role, CURRENT_WAREHOUSE() AS warehouse, CURRENT_ORGANIZATION_NAME() || '-' || CURRENT_ACCOUNT_NAME() AS account_identifier; If warehouse comes back NULL, you'll need to set a default before CoCo Desktop will execute agent queries. The Onboarding Flow Is Deceptively Simple Opening CoCo Desktop for the first time sends you through four screens: welcome, connect, mode, then theme. The first and last are cosmetic. The middle two are where the real work happens. The Connect step is where you either authenticate against an existing connection or create a new one. If you’ve already set up the Cortex Code CLI or Snowflake CLI, CoCo Desktop detects your ~/.snowflake/connections.toml automatically and shows your existing connections with a status dot. This is genuinely convenient — you don't have to re-enter anything. If you're starting fresh, you'll fill in an account identifier, a connection name, a username, and pick an authentication method. The account identifier format trips people up consistently. It follows the pattern orgname-accountname — not the Snowflake URL format, not the legacy account.region format that older tools use. You can find it at app.snowflake.com under your avatar → "Connect a tool to Snowflake." You can also read it directly from your Snowsight URL: https://app.snowflake.com/orgname/accountname/. Worth bookmarking that path if you're setting up multiple team members. The Mode step asks whether to start in Agent mode or Editor mode. This is not a permanent decision — you can switch at any time — but the choice sets the default layout for your first session. Agent mode is optimized for parallel agent sessions across multiple workspaces; Editor mode is optimized for working with files while keeping agent sessions on the side. More on the practical difference between these in Article 2. One thing the onboarding flow doesn’t surface clearly: if your browser doesn’t open automatically for OAuth or SSO, there’s a “Browser didn’t open?” fallback link in the app. It’s easy to miss on first run and results in people assuming the connection failed when it just needs a manual URL copy. Authentication Methods: A Practical Decision Tree CoCo Desktop supports six authentication methods. The four primary ones cover most use cases; two additional methods serve specialized automation scenarios. Which one you choose should depend on your account’s security posture, not just what’s easiest to configure. | Authentication Method | Best For | Credential Storage | Notes || ---------------------------------- | ----------------------------------------- | ----------------------------------- | ------------------------------------------------------------------------------------------------------------ || OAuth ✅ Recommended | Most human users | OS Keychain / DPAPI | Add `client_store_temporary_credential = true`; otherwise re-authentication may be required on every launch. || External Browser / SSO | Organizations using Okta or Azure AD […]