Troubleshoot cross-cloud data access for Snowflake Horizon Catalog

This page shows you how to troubleshoot background metadata refresh for cross-cloud data access with Snowflake Horizon Catalog. For general cross-cloud data access troubleshooting, such as connectivity and routing over private interconnects, see Troubleshoot cross-cloud data access.

Refresh fails with Code 16 (Unauthenticated)

If the background metadata refresh for a Snowflake Horizon Catalog fails with status Code 16 (UNAUTHENTICATED), verify the following:

  • Secret payload formatting: Ensure that the secret token in Secret Manager contains the required JSON structure ({"client_secret": "<var>SNOWFLAKE_PAT_TOKEN</var>", "scope": "session:role:<var>SNOWFLAKE_ROLE</var>"}) rather than the raw Personal Access Token (PAT) string.
  • Token expiration and permissions: Ensure the Snowflake PAT is valid and the associated user and role have sufficient privileges to access the target catalog and databases.
  • Network policy: If a Snowflake network policy is configured, ensure that Google's egress IP address ranges from goog.json are allowlisted.