Auth Token

What is an Auth Token?

An Auth Token is a mandatory credential required to start the Snowflake emulator and activate licensed features. It links your running LocalStack instance to your workspace license and unlocks the services and capabilities available to your account.

Auth Tokens are issued at the workspace level in app.localstack.cloud and are not specific to any single LocalStack product. The same token works across every LocalStack product your account has access to, including LocalStack for AWS, Snowflake, and Azure.

You can manage Auth Tokens from the Auth Tokens page in the LocalStack Web Application.

Credential security

Auth Tokens provide access to your license and workspace. Do not commit tokens to version control. If a token is exposed, rotate it immediately in the LocalStack Web Application.

Token types

Token Type	Scope	Use Case
Developer Token	Individual	Local development workstations. Managed per user.
CI Auth Token	Workspace	Automated pipelines and shared runners. Managed by workspace admins.

Managing your license

To use the LocalStack for Snowflake emulator, a license with access to Snowflake is required. You can get a license by signing up for a free LocalStack account and starting a trial, or by exploring additional features with a paid offering.

After initiating your trial or acquiring a license, assign it to a user:

1. Navigate to the Users & Licenses page.
2. Identify the target user in Workspace Members.
3. Select the appropriate Member Role.
4. Save the configuration to activate the license for that identity.

If you have joined a workspace, you need to be assigned a license by the workspace administrator.

Note

LocalStack cannot activate the Snowflake emulator unless the token belongs to a user or workspace with an assigned license, even if the Auth Token itself is valid.

To view your own assigned license, visit the My License page. For more details on inviting users, assigning licenses, or managing roles, see Users and Licenses.

Configure your token

Authentication requirements vary based on your chosen execution method.

lstk

The lstk CLI automates the authentication lifecycle. On initial execution, it triggers a browser-based OAuth flow and stores the resulting token in your system keyring. No manual environment variable configuration is required.

lstk start --type snowflake

You can alternatively set the LOCALSTACK_AUTH_TOKEN environment variable in your shell session; lstk uses it when no keyring token is present. See Authentication for the full resolution order.

Docker and Docker Compose

For direct container execution, inject the token as an environment variable. For complete startup examples, see the Docker Compose and Docker CLI installation options.

Docker CLI:

-e LOCALSTACK_AUTH_TOKEN=${LOCALSTACK_AUTH_TOKEN}

Docker Compose:

environment:
  - LOCALSTACK_AUTH_TOKEN=${LOCALSTACK_AUTH_TOKEN}

CI environments

CI environments require a CI Auth Token. Developer Auth Tokens cannot be used in CI. CI Auth Tokens are available on the Auth Tokens page and are configured similarly to Developer Auth Tokens.

For complete examples, see the CI Integration guide.

Verify activation

Verify the activation status by querying the Snowflake emulator’s session endpoint:

macOS/Linux

curl -d '{}' snowflake.localhost.localstack.cloud:4566/session

Windows

Invoke-WebRequest -Method POST -Body '{}' -Uri http://snowflake.localhost.localstack.cloud:4566/session

Output

{ "success": true }

You can also check the container logs for a message indicating successful license activation:

[...] Successfully activated license

Otherwise, check the Troubleshooting section below.

Rotate a token

Rotate an Auth Token if it has been exposed, shared accidentally, or stored in a place where it should not be. Go to the Auth Tokens page and select the reset option for the affected token.

After rotation, update every local shell, container configuration, or CI secret that used the old token.

Troubleshooting

The Snowflake emulator requires a successful license activation to start. If activation fails, the container exits and prints an error message similar to:

===============================================
License activation failed!

Reason: The credentials defined in your environment are invalid. Please make sure to set the LOCALSTACK_AUTH_TOKEN variable to a valid auth token. You can find your Auth Token in the LocalStack web app https://app.localstack.cloud.

Due to this error, LocalStack has quit. The Snowflake emulator can only be used with a valid license.

The most common causes are listed below.

Missing credentials

You need to provide an Auth Token to start the Snowflake emulator. You can find your Auth Token on the Auth Tokens page in the LocalStack Web Application.

If you are using lstk, run lstk login to authenticate through a browser-based flow, or set the LOCALSTACK_AUTH_TOKEN environment variable directly.

Invalid license

The issue may occur if there is no valid license linked to your account (for example, because it has expired), or if the license has not been assigned to your user. You can check your license status in the LocalStack Web Application on the My License page. If your license does not grant access to the Snowflake emulator, contact us to upgrade.

License server unreachable

LocalStack initiates offline activation when the license server is unreachable, requiring re-activation every 24 hours. Log output may indicate issues with your machine resolving the LocalStack API domain, which can be verified using a tool like dig:

dig api.localstack.cloud

If the result shows a status other than status: NOERROR, your machine is unable to resolve this domain. Certain corporate DNS servers may filter requests to specific domains. Reach out to your network administrator to safelist the localstack.cloud domain.

If you continue to have problems with license activation, or if the steps above do not help, do not hesitate to contact us.

Next steps

After configuring your Auth Token, continue to the Local Development guide to start the Snowflake emulator and run your first query.