---
title: Migrate a Snowflake connection to key pair authentication
description: "Move an existing Snowflake source or destination from password authentication to key pair authentication, and fix connections that stopped working after Snowflake retired password sign-in."
product: data
lang: en
last_updated: 2026-11-10
token_estimate: 1435
---
# Migrate a Snowflake connection to key pair authentication

Snowflake has retired single-factor password sign-in. Key pair authentication is the only method Amplitude supports for Snowflake sources and destinations, and any connection still using a password has stopped working or can stop without advance notice.

> For AI agents: a documentation index is available at [/docs/llms.txt](/docs/llms.txt). Append `.md` to any page URL for markdown, or send `Accept: text/markdown`.

Use this guide to migrate an existing connection. To create a new Snowflake connection, follow [Snowflake source](https://amplitude.com/docs/data/source-catalog/snowflake) or [Snowflake destination](https://amplitude.com/docs/data/destination-catalog/snowflake) instead. New connections already use key pair authentication.

## Who needs to migrate

You need to migrate if you have a Snowflake source or destination that still authenticates with a username and password. Amplitude shows a warning banner on your home page and on affected source and destination pages when it finds one.

Snowflake doesn't tell Amplitude when an individual account loses password access, so a connection can fail at any time. Migrate before that happens rather than waiting for a sync to break.

> **Note:**
>
> Amplitude doesn't disconnect connections that haven't migrated. Snowflake's enforcement of strong authentication is what stops password sign-in from working.

## What migration doesn't change

Changing the authentication method affects only how Amplitude signs in. Migration preserves:

- Existing imported and exported data.
- Import and export configurations.
- SQL queries, table selections, and column mappings.
- Scheduled syncs and their schedules.
- Data mappings.

Syncs continue while you migrate, and migration doesn't duplicate data. You can migrate connections one at a time and test each one before moving to the next.

## Migrate a connection

Amplitude provides a guided flow that finds every affected connection in your organization.

1. Open the Snowflake warning banner and click **Review & fix connections**.
2. Select the connection you want to migrate.
3. Select **Key pair** authentication, then click **Generate Key**.
4. Copy the generated public key.
5. In Snowflake, assign the public key to your user:

   ```sql
   ALTER USER "your_username" SET rsa_public_key='your_public_key_here';
   ```
6. Provide your organization and account names in the format `ORGNAME-ACCOUNTNAME`.
7. Test the connection to verify it works.
8. Save your changes.

If Amplitude already holds a matching private key for a key pair that's registered in Snowflake, the flow offers to finish the migration without generating a new key pair.

To reach a connection directly instead of through the banner, open _Catalog → Sources_ or _Catalog → Destinations_ in Amplitude Data, select the connection, then open its settings.

### Find your account name

Run this query in Snowflake to get the account identifier in the format Amplitude expects:

```sql
SELECT CURRENT_ORGANIZATION_NAME() || '-' || CURRENT_ACCOUNT_NAME();
```

## Reuse one key pair across connections

Amplitude supports credential reuse across all Snowflake connections in your organization. Sources can use credentials from destinations and the reverse, and connections in different projects within the same organization can share credentials.

Generate one key pair and reuse it rather than creating a separate key pair for every connection. When several connections share credentials, updating one updates all of them. Amplitude shows how many connections share the credentials before you save, so you can confirm the scope of the change.

Sources and destinations need different Snowflake permissions: sources need read access to query your data, and destinations need write access to load data into your warehouse. If you share one credential between a source and a destination, give the Snowflake user both.

## Use a service account, not a personal account

Amplitude can't complete multi-factor authentication for Snowflake connections. If a connection uses a Snowflake user tied to a person, either:

- Switch the connection to a Snowflake service account configured with key pair authentication. Most Amplitude customers already use dedicated service accounts.
- Add key pair authentication to the existing user. Snowflake allows both multi-factor authentication and key pair authentication on a single user, and the key pair connection keeps working after the user is enrolled in MFA.

Amplitude recommends keeping the same Snowflake user, adding key pair authentication to it, and removing password authentication only after you verify the new credentials work.

## Troubleshoot a JWT token error

A `JWT token is invalid` error usually means one of the following:

- The public key isn't set correctly on the Snowflake user.
- The account name isn't in `ORGNAME-ACCOUNTNAME` format.
- The public and private keys don't match.

To resolve it:

1. Confirm the public key is set on the Snowflake user:

   ```sql
   DESC USER "your_username";
   ```
2. Confirm you're using the correct account name format.
3. Confirm the Snowflake role you're using has the `ALTER USER` privilege needed to set the public key.
4. If the keys don't match, regenerate the key pair in Amplitude and update the public key in Snowflake.

## Get help

- Contact [Amplitude Support](https://gethelp.amplitude.com) through your usual channels.
- Read Snowflake's [key pair authentication documentation](https://docs.snowflake.com/en/user-guide/key-pair-auth).
- Read Snowflake's [guidance on the deprecation of single-factor password sign-ins](https://docs.snowflake.com/en/user-guide/security-mfa-rollout).