Creating a Snowflake Credential

Snowflake is phasing out password-based authentication. To connect to Snowflake, use a public/private key pair or a programmatic access token (PAT) instead of a password.

Key Pair Authentication*

1. Generate a public/private key pair by following Snowflake's key pair authentication guide. Confirm your user has permission to use programmatic authentication, per that same guide.
2. Add the public key to your Snowflake user:

ALTER USER your_snowflake_username SET RSA_PUBLIC_KEY='MIIBIjANBgkqh...';

3. In Platform, create a Database credential with your Snowflake username and the full private key (including the BEGIN/END lines) as the password.
4. Use that credential for your Snowflake import or export.

*See Considerations below for a known issue when pasting the private key.

Programmatic Access Token (PAT)

As an alternative to a key pair, you can authenticate using a Snowflake programmatic access token. In Platform, create a Database credential with your Snowflake username and the PAT as the password, then use that credential for your Snowflake import or export.

Note that PATs expire and need to be rotated periodically. When a PAT expires, generate a new one in Snowflake and update the password on the corresponding Platform credential.

Considerations

Pasting a multi-line private key directly into the Password field in the Credentials UI can flatten the newlines into spaces, which breaks authentication. There are two workarounds:

• Create the credential as a Certificate type first, save it, then edit it to change the type to Database.
• Create the credential through the Credentials API endpoint instead, which doesn't have this issue:

client.credentials.post(
    type="Database",
    username="your_snowflake_username",
    password=private_key_contents,  # full PEM, including BEGIN/END lines
    name="Snowflake key pair credential",
    remote_host_id=your_remote_host_id,
)

Have more questions? Submit a request