Snowflake Connector Issue in Claude AI

[rashed091]

MCP server URL

Snowflake MCP

Where does the issue occur?

When pressing the Connect button

Transport used

streamable-http

Client registration type

OpenID Connect Discovery (OIDC)

SSE only: Does your server return the expected status code for POST requests?

Not applicable (my server does not use SSE)

When did you last reproduce this?

2026-03-03

Browser and OS

Chrome

Describe the issue

When attempting to connect the Snowflake MCP integration, the OAuth authorization flow fails with two issues:

The OAuth URL is missing /oauth in the path - Claude redirects to /authorize instead of /oauth/authorize, resulting in a 404 error

The scope parameter is set to scope=claudeai, which Snowflake does not recognize, resulting in "The requested scope is invalid" error

https://..........snowflakecomputing.com/authorize?response_type=code&client_id=...
&redirect_uri=https%3A%2F%2Fclaude.ai%2Fapi%2Fmcp%2Fauth_callback&code_challenge=...&code_challenge_method=S256&state=...&scope=claudeai

Issue details

Error 404 Not Found
Our apologies for the inconvenience. The requested URL was not found on this server. We suggest you try the following:

Verify url and typos - The web page you were attempting to view may not exist or may have moved - try checking the web address for typos.

Expected behavior

Successful login

Logs from your server

Additional context

No response

[rashed091]

Similar issue: #15

[xrousseau]

We're hitting the same issue — /authorize instead of /oauth/authorize, plus the invalid scope. This is blocking high-value use cases for our end users. Would appreciate a fix.

[daveyankowiak]

I'm dealing with this, too. I'm getting the 404 error every time.

[ribolzisalvador]

Having the same issue

[mcd-scarlson]

Running into a related issue. After the OAuth flow, the connection fails with:

"The role ALL requested has been explicitly blocked for use with this application by an administrator."

It appears the connector is sending role=ALL to Snowflake during the connection attempt. ALL is a reserved Snowflake database role that cannot be used as a session/login role and is blocked by Snowflake's security policies. There is no way to configure the role from the connector setup UI — the Connect button fails before any configuration options are presented.

Expected behavior: the connector should either allow users to specify a Snowflake role during setup, or default to the user's default role rather than sending ALL.

[mcd-scarlson]

Additional testing update: attempted to add ALL to the BLOCKED_ROLES_LIST in the Snowflake OAuth Security Integration as a potential workaround, but Snowflake itself rejects it:

SQL compilation error: invalid value [ALL] for parameter 'BLOCKED_ROLES_LIST'

This confirms that ALL is not a valid role value in Snowflake and cannot be handled on the Snowflake side at all. The fix must come from the connector — it should not be sending role=ALL under any circumstances.

[RealEphemeralEuphoria]

Also seeing the /oauth/authorize 404

Hitting the same path bug. Claude generates the following OAuth redirect URL:

https://<redacted>.snowflakecomputing.com/authorize?response_type=code
&client_id=<redacted>
&redirect_uri=https%3A%2F%2Fclaude.ai%2Fapi%2Fmcp%2Fauth_callback
&code_challenge=<redacted>
&code_challenge_method=S256
&state=<redacted>
&scope=claudeai

The missing /oauth in the path causes a 404 before the flow can proceed. We've reproduced this with both the built-in Snowflake connector and a custom connector.

On the scope: Per Snowflake's OAuth docs, valid scopes look like session:role:<role_name> or refresh_token — claudeai doesn't appear to be a recognized value. This aligns with what's reported in #15, where correcting the path still results in "The requested scope is invalid." Worth fixing both at the same time if possible.

[RHayes-IHS]

I know I'm just repeating what has already been said, but I'm hoping maybe it will help get this noticed and resolved faster. This is also blocking our rollout of Claude across our organization.

I've already gone the loop with Anthropic directing me to work with Snowflake, and then Snowflake saying to work with Anthropic. So hopefully we can close the loop somewhere and get this resolved.

Again, I know this is repeat info that has already been said, but here is what I got back from Snowflake support.

Root Cause

After analyzing the browser URL from your screenshot, I've identified the cause of the 404 error. The Claude Desktop Snowflake connector is directing the browser to an incorrect OAuth authorization endpoint:

• What the connector sends: https://######-######.snowflakecomputing.com/authorize

• Correct Snowflake endpoint: https://######-######.snowflakecomputing.com/oauth/authorize

The path /authorize does not exist on Snowflake — the correct path is /oauth/authorize. This is why you see the 404 error. This is a URL construction issue in the Claude Desktop connector itself, not in your Snowflake OAuth configuration.

I also noticed the connector is using scope=claudeai, which is not a recognized Snowflake OAuth scope. Valid scopes are refresh_token and session:role:<ROLE_NAME> (for example, session:role:PUBLIC). This would cause a separate error (390308) even once the endpoint path is corrected.

Recommended Next Steps

Report the bug to Anthropic (the maker of Claude Desktop). The key details to include are:

• The connector calls /authorize but the correct Snowflake OAuth authorization endpoint is /oauth/authorize (per Snowflake OAuth documentation (https://docs.snowflake.com/en/user-guide/oauth-custom#authorization-endpoint))
• The scope claudeai is not a valid Snowflake OAuth scope — it should use session:role:<ROLE_NAME> format (per Snowflake OAuth scope documentation (https://docs.snowflake.com/en/user-guide/oauth-custom#step-2-authorize-the-user))

[viviwall]

I think I'm hitting the same issue.

I'm connecting a Snowflake-managed MCP server using OAuth. After extensive checks the Snowflake side appears correct:

• OAuth login succeeds
• session lands with the correct role + warehouse
• the role can see the MCP server (SHOW MCP SERVERS)
• SQL runs fine in the same session

However Claude still returns:

Error connecting to the MCP server.
Please confirm that you have permission to access the service,
that you're using the correct credentials, and that your server handles auth correctly.

Earlier in testing I also observed the behaviors mentioned in this thread:

• OAuth URL constructed with /authorize instead of /oauth/authorize
• requests including scope=claudeai

After adjusting for those, OAuth progresses further but the MCP connection still fails.

This suggests the failure may occur after authentication during tool initialization, rather than during the OAuth step itself.

Has anyone successfully connected a Snowflake-managed MCP server via OAuth in the Claude client?

[hnipps]

I'm beginning to think this is a Snowflake issue because MCP protocol spec states:

MCP servers MUST implement the OAuth 2.0 Protected Resource Metadata (RFC9728) specification to indicate the locations of authorization servers.

This is essentially a /.well-known/oauth-protected-resource endpoint that provides the location of auth servers.

Snowflake have not implemented this and Anthropic doesn't seem interested in adapting their integration for Snowflake.

Stalemate.

[mremala2024]

Sharing my full investigation in case it helps others:

Native connector → immediate 404 on OAuth redirect (wrong /authorize path + scope=claudeai bugs already documented here).

Custom connector + Snowflake-managed MCP server:

OAuth flow passed ✅
Hit role=ALL block: "The role ALL requested has been explicitly blocked"
Fixed it via:

ALTER SECURITY INTEGRATION CLAUDE_COWORK_OAUTH
SET OAUTH_USE_SECONDARY_ROLES = IMPLICIT;

ALTER USER "username"
SET DEFAULT_ROLE = "SNOWFLAKE-PRODUCTION-CLAUDE-ACCESS";
OAuth now passes with correct role ✅
Still hitting: "Error connecting to the MCP server" ❌
Root cause after digging deeper:
This aligns with what @hnipps described — Snowflake hasn't implemented /.well-known/oauth-protected-resource (RFC9728). The MCP spec requires this endpoint so Claude can discover the auth server location. Even after OAuth completes successfully, Claude can't complete the MCP handshake because Snowflake returns 404 on that endpoint.

So the failure chain is:

Claude → OAuth → passes ✅
Claude → asks Snowflake: "where is your auth server?"
Snowflake → /.well-known/oauth-protected-resource → 404
Claude → cannot complete MCP handshake → "Error connecting to MCP server" ❌
Fixes needed:

Anthropic: fix /authorize → /oauth/authorize, fix scope=claudeai, fix role=ALL default
Snowflake: implement /.well-known/oauth-protected-resource (RFC9728)
OR Anthropic workaround: hardcode Snowflake's auth server URL to bypass discovery
This is blocking our org's rollout of Claude for business users querying Snowflake data. Currently evaluating a self-hosted MCP server as the only viable path forward.

[rashed091]

I was able to set up a local Snowflake MCP server and connect it with Claude Desktop. This resolves my issue for the time being. I also wrote a script to make the integration work smoothly.

#!/bin/bash
set -euo pipefail

# =============================================================================
# Snowflake MCP Server Setup for Claude Desktop
# =============================================================================
#
# FLOW:
#   1. Check dependencies (Python 3.10+, git, curl, jq, Claude Desktop)
#      - Missing on macOS + Homebrew? Offer to auto-install via brew
#      - Missing on macOS without Homebrew? Show Homebrew + brew install commands
#      - Missing on Linux? Show apt/dnf install commands
#
#   2. Install uv/uvx (auto-installs if missing)
#
#   3. Verify Snowflake MCP server package runs
#
#   4. Read Snowflake credentials
#      - Source ~/.zshrc or ~/.bashrc for existing env vars
#      - SNOWFLAKE_ACCOUNT     -> hardcoded: (same for everyone in the company)
#      - SNOWFLAKE_USER        -> use if set, otherwise prompt
#      - SNOWFLAKE_PRIVATE_KEY exists? -> key-pair auth
#      - SNOWFLAKE_PASSWORD exists?    -> password auth
#      - Neither?                      -> prompt for password
#      - SNOWFLAKE_ROLE        -> use if set, otherwise default to AI_ACCESS
#      - SNOWFLAKE_WAREHOUSE   -> use if set, otherwise prompt (default: COMPUTE_WH)
#      - Any prompted/defaulted values get exported to default shell profile
#
#   5. Create ~/snowflake-config.yaml (read-only: SELECT only)
#
#   6. Build MCP server JSON config
#      - private_key mode: env includes SNOWFLAKE_PRIVATE_KEY
#      - password mode:    env includes SNOWFLAKE_PASSWORD + SNOWFLAKE_PRIVATE_KEY=""
#
#   7. Update Claude Desktop config
#      - Existing config? Merge with jq (preserves other settings/servers)
#      - No config? Create new one
#
#   8. Test Snowflake connection via MCP server
#
#   9. Done — print instructions to restart Claude Desktop
#
# USAGE:
#   chmod +x setup-snowflake-mcp.sh   # first time only
#   ./setup-snowflake-mcp.sh
#   # or just: bash setup-snowflake-mcp.sh
#
# =============================================================================

echo "=== Snowflake MCP Server Setup for Claude Desktop ==="
echo ""

MISSING=()

# --- Dependency checks ---

# Python 3.10+
echo "[CHECK] Python..."
if command -v python3 &>/dev/null; then
    PY_VERSION=$(python3 -c 'import sys; print(f"{sys.version_info.major}.{sys.version_info.minor}")')
    PY_MAJOR=$(echo "$PY_VERSION" | cut -d. -f1)
    PY_MINOR=$(echo "$PY_VERSION" | cut -d. -f2)
    if [[ "$PY_MAJOR" -ge 3 && "$PY_MINOR" -ge 10 ]]; then
        echo "  [OK] Python $PY_VERSION"
    else
        echo "  [FAIL] Python $PY_VERSION found, but 3.10+ is required"
        MISSING+=("python3 (>= 3.10)")
    fi
else
    echo "  [FAIL] python3 not found"
    MISSING+=("python3 (>= 3.10)")
fi

# git (needed to install from git+https)
echo "[CHECK] git..."
if command -v git &>/dev/null; then
    echo "  [OK] git $(git --version | awk '{print $3}')"
else
    echo "  [FAIL] git not found"
    MISSING+=("git")
fi

# curl (needed to install uv if missing)
echo "[CHECK] curl..."
if command -v curl &>/dev/null; then
    echo "  [OK] curl found"
else
    echo "  [FAIL] curl not found"
    MISSING+=("curl")
fi

# jq (needed to merge into existing Claude Desktop config)
echo "[CHECK] jq..."
if command -v jq &>/dev/null; then
    echo "  [OK] jq $(jq --version)"
else
    echo "  [FAIL] jq not found (needed to update Claude Desktop config)"
    MISSING+=("jq")
fi

# Claude Desktop
echo "[CHECK] Claude Desktop..."
if [[ "$OSTYPE" == "darwin"* ]]; then
    if [[ -d "/Applications/Claude.app" ]]; then
        echo "  [OK] Claude Desktop installed"
    else
        echo "  [FAIL] Claude Desktop not found at /Applications/Claude.app"
        MISSING+=("Claude Desktop (https://claude.ai/download)")
    fi
elif [[ "$OSTYPE" == "msys" || "$OSTYPE" == "cygwin" || "$OSTYPE" == "win32" ]]; then
    if [[ -d "$LOCALAPPDATA/Programs/claude-desktop" || -d "$PROGRAMFILES/Claude" ]]; then
        echo "  [OK] Claude Desktop installed"
    else
        echo "  [WARN] Could not detect Claude Desktop. Make sure it is installed."
    fi
else
    echo "  [WARN] Cannot auto-detect Claude Desktop on this OS. Make sure it is installed."
fi

# Abort if missing dependencies
if [[ ${#MISSING[@]} -gt 0 ]]; then
    echo ""
    echo "=== Missing Dependencies ==="
    echo "Please install the following before re-running this script:"
    echo ""
    for dep in "${MISSING[@]}"; do
        echo "  - $dep"
    done
    echo ""
    if [[ "$OSTYPE" == "darwin"* ]]; then
        if command -v brew &>/dev/null; then
            echo ""
            read -rp "Install missing dependencies with Homebrew? [Y/n]: " INSTALL_CONFIRM
            INSTALL_CONFIRM="${INSTALL_CONFIRM:-Y}"
            if [[ "$INSTALL_CONFIRM" =~ ^[Yy]$ ]]; then
                BREW_PKGS=()
                for dep in "${MISSING[@]}"; do
                    case "$dep" in
                        "python3 (>= 3.10)") BREW_PKGS+=("python@3.12") ;;
                        "git")               BREW_PKGS+=("git") ;;
                        "curl")              BREW_PKGS+=("curl") ;;
                        "jq")                BREW_PKGS+=("jq") ;;
                    esac
                done
                if [[ ${#BREW_PKGS[@]} -gt 0 ]]; then
                    echo "[INFO] Running: brew install ${BREW_PKGS[*]}"
                    brew install "${BREW_PKGS[@]}"
                    echo ""
                    echo "[OK] Dependencies installed. Re-running setup..."
                    echo ""
                    exec "$0" "$@"
                fi
            else
                echo ""
                echo "Install manually with:"
                echo "  brew install python@3.12 git curl jq"
                exit 1
            fi
        else
            echo ""
            echo "On macOS, install Homebrew first:"
            echo '  /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"'
            echo ""
            echo "Then install dependencies:"
            echo "  brew install python@3.12 git curl jq"
            exit 1
        fi
    else
        echo "On Linux:"
        echo "  sudo apt install python3 git curl jq   # Debian/Ubuntu"
        echo "  sudo dnf install python3 git curl jq   # Fedora/RHEL"
        exit 1
    fi
fi

echo ""
echo "[OK] All dependencies satisfied"
echo ""

# --- Step 1: Check/install uv ---
if command -v uvx &>/dev/null; then
    UVX_PATH="$(command -v uvx)"
    echo "[OK] uvx found at: $UVX_PATH"
else
    echo "[INFO] uvx not found. Installing uv..."
    curl -LsSf https://astral.sh/uv/install.sh | sh
    export PATH="$HOME/.local/bin:$PATH"
    if command -v uvx &>/dev/null; then
        UVX_PATH="$(command -v uvx)"
        echo "[OK] uv installed. uvx at: $UVX_PATH"
    else
        echo "[ERROR] uv installation failed. Install manually: https://docs.astral.sh/uv/"
        exit 1
    fi
fi

# --- Step 2: Verify the Snowflake MCP package ---
echo ""
echo "[INFO] Testing Snowflake MCP server package (first run may take a minute)..."
if "$UVX_PATH" --from "git+https://github.com/Snowflake-Labs/mcp" mcp-server-snowflake --help &>/dev/null; then
    echo "[OK] Snowflake MCP server package works"
else
    echo "[ERROR] Failed to run Snowflake MCP server. Check your Python/uv installation."
    exit 1
fi

# --- Step 3: Read credentials from shell environment or prompt ---
echo ""
echo "[CHECK] Snowflake environment variables..."

# Detect default shell profile
if [[ -n "${ZSH_VERSION:-}" || "$SHELL" == */zsh ]]; then
    SHELL_RC="$HOME/.zshrc"
else
    SHELL_RC="$HOME/.bashrc"
fi

# Source shell profile to pick up existing exports
source "$SHELL_RC" 2>/dev/null || true

SF_ACCOUNT="${SNOWFLAKE_ACCOUNT:-}"
SF_USER="${SNOWFLAKE_USERNAME:-${SNOWFLAKE_USER:-}}"
SF_PASS="${SNOWFLAKE_PASSWORD:-}"
SF_PRIVATE_KEY="${SNOWFLAKE_PRIVATE_KEY:-}"
EXPORTS_TO_ADD=()

# Account (fixed for all users)
SF_ACCOUNT="SNOWFLAKE_ACCOUNT"
echo "  [OK] SNOWFLAKE_ACCOUNT=$SF_ACCOUNT"

# User
if [[ -n "$SF_USER" ]]; then
    echo "  [OK] SNOWFLAKE_USER=$SF_USER"
else
    read -rp "  Snowflake username (e.g. USER@COMPANY.COM): " SF_USER
    if [[ -z "$SF_USER" ]]; then
        echo "  [ERROR] Username is required."
        exit 1
    fi
    EXPORTS_TO_ADD+=("export SNOWFLAKE_USERNAME='$SF_USER'")
fi

# Auth: prefer private key from env, otherwise use password
if [[ -n "$SF_PRIVATE_KEY" ]]; then
    AUTH_MODE="private_key"
    echo "  [OK] SNOWFLAKE_PRIVATE_KEY found — using key-pair authentication"
elif [[ -n "$SF_PASS" ]]; then
    AUTH_MODE="password"
    echo "  [OK] SNOWFLAKE_PASSWORD found — using password authentication"
else
    read -rsp "  Snowflake password: " SF_PASS
    echo ""
    if [[ -z "$SF_PASS" ]]; then
        echo "  [ERROR] Password is required."
        exit 1
    fi
    AUTH_MODE="password"
    EXPORTS_TO_ADD+=("export SNOWFLAKE_PASSWORD='$SF_PASS'")
fi

# Role (default: AI_ACCESS — controls what databases/schemas/tables Claude can see)
SF_ROLE="${SNOWFLAKE_ROLE:-}"
if [[ -n "$SF_ROLE" ]]; then
    echo "  [OK] SNOWFLAKE_ROLE=$SF_ROLE"
else
    SF_ROLE="AI_ACCESS"
    echo "  [INFO] SNOWFLAKE_ROLE not set — defaulting to AI_ACCESS"
    EXPORTS_TO_ADD+=("export SNOWFLAKE_ROLE='$SF_ROLE'")
fi

# Warehouse
SF_WAREHOUSE="${SNOWFLAKE_WAREHOUSE:-}"
if [[ -n "$SF_WAREHOUSE" ]]; then
    echo "  [OK] SNOWFLAKE_WAREHOUSE=$SF_WAREHOUSE"
else
    read -rp "  Snowflake warehouse [ANALYST_WH]: " SF_WAREHOUSE
    SF_WAREHOUSE="${SF_WAREHOUSE:-ANALYST_WH}"
    EXPORTS_TO_ADD+=("export SNOWFLAKE_WAREHOUSE='$SF_WAREHOUSE'")
fi

# Write missing exports to shell profile
if [[ ${#EXPORTS_TO_ADD[@]} -gt 0 ]]; then
    echo ""
    echo "[INFO] Adding Snowflake credentials to $SHELL_RC..."
    echo "" >> "$SHELL_RC"
    echo "# Snowflake credentials (added by setup-snowflake-mcp.sh)" >> "$SHELL_RC"
    for line in "${EXPORTS_TO_ADD[@]}"; do
        echo "$line" >> "$SHELL_RC"
    done
    echo "  [OK] Added ${#EXPORTS_TO_ADD[@]} export(s) to $SHELL_RC"
fi

# --- Step 4: Create snowflake-config.yaml ---
CONFIG_YAML="$HOME/snowflake-config.yaml"
cat > "$CONFIG_YAML" <<'YAML'
other_services:
  object_manager: true
  query_manager: true
  semantic_manager: true

sql_statement_permissions:
  - Select: true
  - Insert: false
  - Update: false
  - Delete: false
  - Create: false
  - Drop: false
  - Alter: false
  - Unknown: false
YAML
echo "[OK] Created $CONFIG_YAML"

# --- Step 5: Determine Claude Desktop config path ---
if [[ "$OSTYPE" == "darwin"* ]]; then
    CLAUDE_CONFIG_DIR="$HOME/Library/Application Support/Claude"
elif [[ "$OSTYPE" == "msys" || "$OSTYPE" == "cygwin" || "$OSTYPE" == "win32" ]]; then
    CLAUDE_CONFIG_DIR="$APPDATA/Claude"
else
    CLAUDE_CONFIG_DIR="$HOME/.config/Claude"
fi

CLAUDE_CONFIG="$CLAUDE_CONFIG_DIR/claude_desktop_config.json"
mkdir -p "$CLAUDE_CONFIG_DIR"

# --- Step 6: Build the snowflake MCP server entry ---
if [[ "$AUTH_MODE" == "private_key" ]]; then
    SNOWFLAKE_MCP=$(cat <<EOF
{
  "command": "$UVX_PATH",
  "args": [
    "--from",
    "git+https://github.com/Snowflake-Labs/mcp",
    "mcp-server-snowflake",
    "--service-config-file",
    "$CONFIG_YAML"
  ],
  "env": {
    "SNOWFLAKE_ACCOUNT": "$SF_ACCOUNT",
    "SNOWFLAKE_USER": "$SF_USER",
    "SNOWFLAKE_PRIVATE_KEY": "$SF_PRIVATE_KEY",
    "SNOWFLAKE_ROLE": "$SF_ROLE",
    "SNOWFLAKE_WAREHOUSE": "$SF_WAREHOUSE"
  }
}
EOF
)
else
    SNOWFLAKE_MCP=$(cat <<EOF
{
  "command": "$UVX_PATH",
  "args": [
    "--from",
    "git+https://github.com/Snowflake-Labs/mcp",
    "mcp-server-snowflake",
    "--service-config-file",
    "$CONFIG_YAML"
  ],
  "env": {
    "SNOWFLAKE_ACCOUNT": "$SF_ACCOUNT",
    "SNOWFLAKE_USER": "$SF_USER",
    "SNOWFLAKE_PASSWORD": "$SF_PASS",
    "SNOWFLAKE_PRIVATE_KEY": "",
    "SNOWFLAKE_ROLE": "$SF_ROLE",
    "SNOWFLAKE_WAREHOUSE": "$SF_WAREHOUSE"
  }
}
EOF
)
fi

# --- Step 7: Merge into existing config or create new one ---
if [[ -f "$CLAUDE_CONFIG" ]]; then
    echo "[INFO] Existing Claude Desktop config found. Adding snowflake server..."
    UPDATED=$(jq --argjson sf "$SNOWFLAKE_MCP" '.mcpServers.snowflake = $sf' "$CLAUDE_CONFIG")
    echo "$UPDATED" > "$CLAUDE_CONFIG"
else
    echo "[INFO] Creating new Claude Desktop config..."
    cat > "$CLAUDE_CONFIG" <<CONF
{
  "mcpServers": {
    "snowflake": $SNOWFLAKE_MCP
  }
}
CONF
fi

echo "[OK] Claude Desktop config updated at: $CLAUDE_CONFIG"

# --- Step 8: Quick connection test ---
echo ""
echo "[INFO] Testing Snowflake connection ($AUTH_MODE)..."
if timeout 30 "$UVX_PATH" --from "git+https://github.com/Snowflake-Labs/mcp" \
   mcp-server-snowflake \
   --service-config-file "$CONFIG_YAML" 2>&1 | grep -q "Initializing tools"; then
    echo "[OK] Snowflake connection successful!"
else
    echo "[WARN] Could not verify connection. Check credentials if it fails in Claude Desktop."
fi

echo ""
echo "=== Setup Complete ==="
echo ""
echo "Next steps:"
echo "  1. Fully quit Claude Desktop (Cmd+Q on Mac, or Task Manager on Windows)"
echo "  2. Reopen Claude Desktop"
echo "  3. Look for the hammer/tools icon in the chat input"
echo "  4. Try: 'List all databases in my Snowflake account'"