Select a worksheet and click Detokenize.
Lookup by Token (Detokenize)
Paste a token value to retrieve the corresponding plaintext — no worksheet needed.
Search by Value (Tokenize + Filter)
Type a plaintext value to get its token — then apply as a filter on the worksheet.
Apply as Worksheet Filter
Exact column name as it appears in Tableau
Configuration
Direct SPCS endpoint — extension calls SPCS from the browser (no proxy)
Sent as: Snowflake Token="<value>"
Sent as: sf-context-current-account (required for RBAC / detok)
Sent as: sf-context-current-region (required for RBAC / detok)
Per-user sign-in (OIDC / PKCE) — optional
When set, viewers sign in to your IdP and their signed token is sent to the dataplane for RBAC. Leave blank to use PAT only.
Your IdP's authorize endpoint (Entra/Okta/Ping)
Token endpoint (must allow CORS for a SPA/public client)
Register as SPA/public client. Redirect URI = this extension's origin + /oauth/callback
Add the scope that emits your groups/roles claim
Format: ColumnName:fieldtype — fieldtype must be one of: name, ssn, email