Snowflake is phasing out password authentication for service users. If a pipeline of yours signs in to Snowflake with a username and password today, that pipeline has a clock on it.
The Databasin Snowflake connector now supports key-pair authentication. Pick Key Pair as the auth type, paste your private key, and you're done.
What you fill in
Three fields, one of them optional:
- Username — the Snowflake user the key belongs to
- Private Key (PEM) — the key itself
- Private Key Passphrase — only if your key is encrypted
Encrypted and unencrypted keys both work. If your security team hands you a passphrase-protected key, it goes in as-is; if it doesn't have one, leave the field blank.
Password authentication is still there and still first in the list, so nothing you already have changes. This is an option you take when you're ready, or when Snowflake makes the decision for you.
It works everywhere the connector works
The part that's easy to get wrong — and that we specifically went back and fixed — is that an auth method has to work on every path, not just the one you test first. A key that passes Test Connection and then fails when you browse for a table is worse than no support at all, because you find out halfway through building something.
Key-pair auth works across testing the connection, browsing schemas and tables, previewing data, and every scheduled ingestion run.
Where the key lives
Your private key is stored in the same managed secret vault as every other credential you give Databasin. When a run needs it on disk, the file is created with owner-only permissions before a single byte is written to it, and removed when the process exits. It is never written to a log.
One thing to know
Live federation — querying Snowflake as a live catalog without syncing — is still password-only today. If you use both, the ingestion side can move to key-pair now, and the live side needs to keep its password until we finish that work. We would rather tell you that than let you find it on a Friday.
If you run Snowflake, this is worth doing ahead of the change rather than during it — check Snowflake's own guidance for the dates that apply to your account. Open the connector, switch the auth type, paste the key.