Programmatic access from within Snowflake

These instructions help you call an API or a Model Context Protocol (MCP) server that you deployed to Posit Connect. They apply when your code runs inside the Posit Team Native App, such as a Workbench session or content running on Connect.

Use the instructions in Programmatic access from outside Snowflake when your code runs outside Snowflake, such as a script on your laptop or an MCP client on your own machine.

Requests made within the application never pass through Snowflake Snowpark Container Services (SPCS) ingress, so they carry no Snowflake credential. Connect is available at https://connect and authenticates the caller the way it does in any other installation, with a Connect API key. The Connect API reference describes the rest.

Credentials

Connect sets CONNECT_SERVER and CONNECT_API_KEY in every content process, so content deployed to Connect reads both without any configuration. The key it receives belongs to the content owner and lasts only as long as the process.

A Workbench session receives neither. Provision an API key and set both variables yourself, which keeps the key out of your code. The Connect cookbook follows the same convention.

Terminal
export CONNECT_SERVER="https://connect"
export CONNECT_API_KEY="<your-connect-api-key>"

Connect includes a trailing slash in the value it sets, so the examples below drop it before joining a path.

Dependencies

The examples use requests in Python and httr2 in R.

Terminal
python -m pip install requests
R console
install.packages("httr2")

Call an API

Connect serves deployed content at https://connect/content/<content-guid>/, followed by the path your API exposes.

call_api.py
import os
import requests

CONNECT_SERVER = os.environ["CONNECT_SERVER"].rstrip("/")
CONNECT_API_KEY = os.environ["CONNECT_API_KEY"]
API_PATH = "/content/<content-guid>/path/to/api"

session = requests.Session()
session.headers["Authorization"] = f"Key {CONNECT_API_KEY}"

response = session.get(f"{CONNECT_SERVER}{API_PATH}")
response.raise_for_status()
print(response.json())

The session behaves like any other requests session, so session.post(...) with json=, query parameters, and timeouts work as usual. It also reaches the Connect server API.

call_api.py
# List the content on this Connect installation, including each content GUID.
response = session.get(f"{CONNECT_SERVER}/__api__/v1/content")
R console
library(httr2)

connect_server <- sub("/$", "", Sys.getenv("CONNECT_SERVER"))
connect_api_key <- Sys.getenv("CONNECT_API_KEY")
api_url <- paste0(connect_server, "/content/<content-guid>/path/to/api")

req <- request(api_url)
req <- req_headers(req, Authorization = paste("Key", connect_api_key))
resp <- req_perform(req)
resp_body_json(resp)

The request behaves like any other httr2 request, so req_body_json(), query parameters, and timeouts work as usual. It also reaches the Connect server API.

R console
# List the content on this Connect installation, including each content GUID.
req <- request(paste0(connect_server, "/__api__/v1/content"))
req <- req_headers(req, Authorization = paste("Key", connect_api_key))
resp <- req_perform(req)
Note

The Native App installs its certificate authority into the system trust store in each container at startup, so certificate verification needs no configuration. R reads that store through libcurl. If a Python process reports a certificate verification failure, it did not pick up the store: pass verify="/etc/ssl/certs/ca-certificates.crt" to the request, or set the REQUESTS_CA_BUNDLE environment variable to that path.

Use an MCP server

Connect serves an MCP server at its content URL followed by /mcp, which within the application is https://connect/content/<content-guid>/mcp. Each client sends the API key in one header.

Each client reads the key from CONNECT_API_KEY, so export it as shown in Credentials before starting the client. Visual Studio Code prompts for the value instead of reading the environment.

Posit Assistant reads MCP server definitions from ~/.posit/assistant/settings.json for all projects, or from .posit/assistant/settings.json within one project.

~/.posit/assistant/settings.json
{
  "mcpServers": {
    "my-mcp-server": {
      "type": "remote",
      "url": "https://connect/content/<content-guid>/mcp",
      "headers": {
        "Authorization": "Key {env:CONNECT_API_KEY}"
      }
    }
  }
}

Visual Studio Code prompts for the input the first time it starts the server, then stores the value securely.

.vscode/mcp.json
{
  "inputs": [
    {
      "id": "connect-api-key",
      "type": "promptString",
      "description": "Connect API key",
      "password": true
    }
  ],
  "servers": {
    "my-mcp-server": {
      "type": "http",
      "url": "https://connect/content/<content-guid>/mcp",
      "headers": {
        "Authorization": "Key ${input:connect-api-key}"
      }
    }
  }
}

Add the server to your project configuration from a terminal in your session. Single quotes keep the environment variable name in the file rather than writing your API key into it.

Terminal
claude mcp add --transport http --scope project my-mcp-server \
  "https://connect/content/<content-guid>/mcp" \
  --header 'Authorization: Key ${CONNECT_API_KEY}'

That command writes the following configuration, which you can also edit directly.

.mcp.json
{
  "mcpServers": {
    "my-mcp-server": {
      "type": "http",
      "url": "https://connect/content/<content-guid>/mcp",
      "headers": {
        "Authorization": "Key ${CONNECT_API_KEY}"
      }
    }
  }
}

Notes

  • Connect identifies the caller by the API key, so the key must belong to a user that the content access settings permit.
  • Content that allows anonymous access needs no API key. Omit the Authorization header in that case.
  • The internal address https://connect does not resolve outside the Native App, and a caller inside the application cannot use the ingress URL. Within the application, Connect presents a certificate issued for its internal name, so a request to the ingress URL fails the TLS check before it reaches authentication.
Back to top