Snowflake Key-Pair Authentication: June - August 2026

Snowflake is phasing out password-based authentication in stages. Keboola is fully ready for this transition — both workspaces and component configurations can use key-pair authentication today.

Happening now — Phase 2 (new users). Snowflake is rolling out the milestone that stops new password-based (LEGACY_SERVICE) users from being created, which is the mechanism behind newly created workspaces. The platform already handles this, so you shouldn't notice anything. For BYODB stacks the change is expected to switch on around June 16, 2026. We don't expect any disruption — but if you do hit an issue creating a workspace, please reach out to us right away.

Coming later — Phase 3 (existing users), the decisive milestone. Starting in August 2026, Snowflake migrates all existing LEGACY_SERVICE users to the SERVICE type and blocks password authentication entirely. Any workspace or component configuration still using a password will stop working. (Snowflake rollout details)

What you need to do before August 2026:

1. Migrate your component configurations to key-pair authentication. Open each flagged configuration, switch the authentication type to key-pair in its credentials, paste the private key, then save and test. Warnings disappear automatically once a configuration uses key-pair authentication. See the step-by-step guide.
2. Migrate your workspaces that were created with password-based access to key-pair authentication.

There's no need to wait — the platform is ready now, and migrating early avoids any runtime failures once Snowflake enforces the change. If you run into a configuration that needs help, reach out to support.