Snowflake Workspaces and Authentication Changes Coming in 2025
Earlier this year, we announced changes for Keboola customers using the Snowflake backend. With Snowflake’s recent updates, we’ve prepared a refreshed timeline of the most impactful changes to your experience.
ℹ️ How to Read This Changelog
Some changes apply only to specific customer types using the Snowflake backend for their Keboola projects:
- BYODB (Bring Your Own Database) - Contract customers using a dedicated Snowflake account for their project (direct ownership, reseller deal, or a dedicated account provided by Keboola).
- MT (Multi-tenant) - Contract customers using Keboola’s Snowflake backend shared with other multi-tenant customers.
- PAYG (Pay As You Go) – Customers paying directly for usage on Keboola’s Snowflake backend shared with other PAYG customers.
- ✅ = This change applies to you
- ❌ = This change does not apply to you
We recommend scanning only the sections with ✅ for your customer type.
⚠️ Crucial Workspace Access Change
By December 2025, all customers using Keboola’s shared Snowflake backend (MT/PAYG) will lose direct access to SQL workspaces, as Snowflake prohibits shared accounts across customers.
They will no longer be able to log in to the Snowflake UI environment, nor connect through external tools such as IDEs or BI platforms. We will provide new tools to support SQL development and connect the BI tools.
See the timeline of changes for more details.
📅 Timeline of Changes
September 30, 2025
Snowflake SQL Workspaces: Key Pair as Default Authentication
- ✅ BYODB
- ✅ MT
- ✅ PAYG
In July, we introduced a new authentication method for Snowflake SQL workspaces - Key Pair & SSO.
Since Snowflake will soon deprecate single-factor password authentication, the default method for creating new workspaces will now be Key Pair.
October 31, 2025
Snowflake SQL Workspaces Migration Tool
- ✅ BYODB
- ✅ MT
- ✅ PAYG
Some users may heavily rely on their legacy workspaces with password authentication—whether for long-term BI tool database schemas or for worksheets with scripts they want to keep. To support them with the change, we are introducing a migration tool that allows them to easily switch a workspace’s authentication method to Key Pair.
This ensures they can keep all workspace content intact. The only required step will be updating the authentication method for any tool accessing that workspace (and its underlying Snowflake schema), changing it from Password to Key Pair.
The migration is irreversible.
Data Gateway Component Production Release
- ☑️ BYODB
- ✅ MT
- ✅ PAYG
The Data Gateway (currently in private beta) allows users to share data from Keboola Storage in read-only mode via a Snowflake schema that exists outside Keboola’s shared database. Its main purpose is to provide access for third-party BI tools, serving as a replacement for regular Snowflake workspaces, which MT/PAYG users will no longer be able to use.
The component uses Key Pair as the only authentication method. If your third-party tools do not yet support this, we recommend continuing with legacy Snowflake workspaces, which still use username/password authentication. All relevant tools are already adopting the Key Pair authentication method or have it in the product release plan.
BYODB - Use of this component is optional for customers with a dedicated Snowflake account. Since it spins up an additional Snowflake warehouse outside the account, it may unnecessarily increase Snowflake usage. In this case, customers can use SQL workspaces or create schemas directly in their database, hence sharing resources with other Keboola components utilizing Snowflake. Our support team can help with the best solution for the customer's use case.
November 30, 2025
Snowflake SQL Workspaces: Password Authentication Deprecated
- ✅ BYODB
- ✅ MT
- ✅ PAYG
As announced by Snowflake, customers will no longer be able to create new legacy workspaces that support single-factor password authentication (find out more in the official Snowflake documentation).
To align with this global Snowflake change, we will remove the option to create legacy workspaces from the UI. Going forward, only Key Pair (for third-party tools) and SSO (for Snowsight) will be supported.
Keboola SQL Editor in Production
- ✅ BYODB
- ✅ MT
- ✅ PAYG
Keboola’s own SQL editor (currently in private beta) will soon be publicly available on the platform, allowing SQL development directly within Keboola. While third-party IDEs offer a wide range of features, the native Keboola SQL editor lets you analyze data and prepare transformations without needing to authenticate external tools or leave the project context.
With the upcoming workspace access changes, this editor will serve as the go-to solution for SQL development for customers using Keboola’s shared Snowflake backend (MT/PAYG).
Snowflake Writer: Remove Option to Choose Keboola Snowflake Database
- ✅ BYODB
- ✅ MT
- ✅ PAYG
We will simplify Snowflake Writer to function as any other database writer - loading data to existing databases.
The option to use Keboola Snowflake database has been used mainly for connecting 3rd party BI tools. With the introduction of Data Gateway for MT/PAYG customers and due to the fact BYODB customers have their own database, this option won’t be relevant anymore.
We will introduce a migration tool which will help users switch from Snowflake writer with Keboola Snowflake database to the Data Gateway component.
December 31, 2025
⚠️ PAYG and MT Customers Lose Direct Access to Snowflake Workspaces
- ❌ BYODB
- ✅ MT
- ✅ PAYG
By the end of the year, all customers using Keboola’s shared Snowflake backend (MT/PAYG) will lose direct access to Snowflake. This aligns with Snowflake’s policies for shared account environments.
We know this is a significant change, and it will impact many of our loyal customers. Here are the available paths forward:
Options for MT Customers
- Continue using Keboola’s shared Snowflake backend with the SQL Editor and Data Gateway component, which provide a robust set of tools for ETL pipelines—without needing a dedicated Snowflake account.
- For those requiring more Snowflake features or direct access, we offer dedicated Snowflake accounts. We are proactively contacting heavy SQL users with this option. If you haven’t been contacted and believe this fits your needs, please reach out to your account manager or our support team.
- Alternatively, switch to BigQuery, though this usually requires effort to re-write existing Snowflake transformations into the BigQuery dialect.
Options for PAYG Customers
- Use the SQL Editor and Data Gateway tools, similar to MT customers.
- Switch to a BigQuery PAYG project by creating a new one via our wizard. If you have prepaid credits in your Snowflake PAYG project, our support team can help transfer them.
Move to a regular contract, either BYODB (Snowflake/BigQuery) or MT BigQuery. This option best suits customers looking to expand their Keboola usage, though it naturally involves higher costs.
June 30, 2026
Snowflake Fully Deprecates Single-Factor Password Authentication
- ✅ BYODB
- ❌ MT
- ❌ PAYG
When this change takes effect, only BYODB customers will still have access to Snowflake workspaces. All existing workspaces must be migrated to Key Pair authentication; otherwise, access will stop working once Snowflake rolls out this change.