Skip to main content
This guide walks you through connecting Gumloop to Snowflake using RSA key-pair (JWT) authentication. Key-pair auth uses a private/public key pair instead of a password or browser login, which makes it ideal for service users and for accounts where multi-factor authentication (MFA) is enforced.
When to use Key-Pair: Key-pair authentication is the best fit for service (non-human) users and for accounts with MFA enforced, since JWT-based connections are not prompted for an interactive MFA challenge. If you prefer browser-based login with automatic token refresh, use Snowflake OAuth instead.

​
What This Guide Covers

Generate a key pair

Create an RSA private/public key pair in PEM (PKCS#8) format.

Register the public key

Assign the public key to your Snowflake user with ALTER USER.

Configure Gumloop

Add your Snowflake Key-Pair credential in the Connectors page.

Verify & troubleshoot

Confirm the connection and resolve common errors.

​
Which Authentication Method Should You Use?

Gumloop supports three ways to authenticate to Snowflake. You only need one.

OAuth (Recommended)

Browser-based login with automatic token refresh and centralized control. Set up OAuth →

Key-Pair

RSA JWT auth. Best for service users and MFA-enforced accounts. You are here.

PAT

Programmatic Access Token (username + token). Set up PAT →
When multiple Snowflake credentials exist, Gumloop resolves them in this order: OAuth → Key-Pair → PAT. For a clean setup, configure just the one method you intend to use.

​
Prerequisites

Before you begin, ensure you have:
  • Snowflake account access — a user account you can run ALTER USER on (or a Snowflake admin who can do it for you)
  • Account identifier — the first part of your Snowflake URL, e.g. myorg-account123 from https://myorg-account123.snowflakecomputing.com
  • OpenSSL (or any tool that can generate an RSA key in PKCS#8 format) available on your machine
  • Public internet access to Snowflake — Gumloop connects to your account over the public internet (see the PrivateLink note below)
PrivateLink accounts are not supported with Gumloop’s standard (cloud-hosted) deployment unless you whitelist Gumloop’s static egress IPs in your Snowflake network policy. Key-pair authentication requires Gumloop to reach your Snowflake account over the public internet. If your account is behind AWS PrivateLink, Azure Private Link, or Google Cloud Private Service Connect and you cannot whitelist Gumloop’s IPs, connections will fail.The solution is a VPC deployment, where Gumloop runs inside your network perimeter. Contact support@gumloop.com to explore VPC deployment options.

​
Step 1: Generate an RSA Key Pair

Run these commands locally to create the key pair. Gumloop requires the private key in PEM (PKCS#8) format.

​
1.1 Generate the private key

This creates rsa_key.p8, a PEM file that begins with -----BEGIN PRIVATE KEY----- (unencrypted) or -----BEGIN ENCRYPTED PRIVATE KEY----- (encrypted).

​
1.2 Generate the matching public key

This creates rsa_key.pub, which begins with -----BEGIN PUBLIC KEY-----.
Store rsa_key.p8 securely and never commit it to version control. You’ll paste its contents into Gumloop in Step 3.

​
Step 2: Register the Public Key in Snowflake

Assign the public key to the Snowflake user Gumloop will connect as.

​
2.1 Assign the public key

In a Snowflake worksheet, run ALTER USER with the contents of rsa_key.pub — excluding the -----BEGIN PUBLIC KEY----- / -----END PUBLIC KEY----- header lines:
Assigning a public key requires the SECURITYADMIN role (or higher), or the OWNERSHIP/ALTER privilege on the user. If you don’t have this, ask your Snowflake administrator to run the command for you.

​
2.2 Verify the key was registered

Check that the RSA_PUBLIC_KEY_FP property (the key fingerprint) is populated.

​
Step 3: Configure Gumloop

​
3.1 Add the Snowflake Key-Pair credential

  1. Go to the Connectors page (Snowflake Key-Pair) — this link pre-filters the list to Snowflake Key-Pair
  2. Click Add credential on the Snowflake Key-Pair option

​
3.2 Fill in the credential fields

  1. Click Save.
Paste the entire private key including the -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY----- lines. Gumloop normalizes the formatting automatically, so it’s fine if line breaks are lost when copying.
Only one Snowflake Key-Pair credential can be configured per account.

​
Step 4: Verify Your Connection

The quickest way to confirm the key-pair connection works is with an agent:
  1. Create a new agent
  2. Click Add Connectors, search for Snowflake, add it, and click Save
  3. Ask it to run a simple query, for example:
  1. Confirm the agent returns your Snowflake username
Once verified, key-pair credentials work anywhere Snowflake authentication is used in Gumloop, including the Snowflake MCP integration and the Snowflake Reader node.
Snowflake network policies restrict which IP addresses can connect. If your account has network policies enabled, key-pair connections from Gumloop may be blocked unless Gumloop’s static egress IPs are added to your allowed list.
  • Production: Whitelist Gumloop’s static egress IPs in your Snowflake network policy.
  • PrivateLink: Not supported on the standard cloud-hosted deployment unless the static egress IPs are whitelisted — otherwise a VPC deployment is required.

​
Troubleshooting

  • Make sure you pasted the private key (rsa_key.p8), not the public key (rsa_key.pub).
  • The key must be in PEM (PKCS#8) format — it should start with -----BEGIN PRIVATE KEY----- or -----BEGIN ENCRYPTED PRIVATE KEY-----.
  • If the key is encrypted, confirm the Private Key Passphrase field matches the passphrase you set during generation.
  • The public key registered on the Snowflake user must be the pair of the private key you added to Gumloop. Re-run Step 2 with the rsa_key.pub that matches your rsa_key.p8.
  • Verify the fingerprint is set with DESC USER my_service_user; and check RSA_PUBLIC_KEY_FP.
  • Confirm the Username in Gumloop exactly matches the Snowflake user the key is registered on.
  • Whitelist Gumloop’s static egress IPs in your Snowflake network policy.
  • PrivateLink accounts require the static egress IPs to be whitelisted, or a VPC deployment.
  • Ensure your user’s role has the USAGE privilege on the warehouse.
  • Specify the warehouse explicitly in the Snowflake Reader node, or set a default warehouse for the user.

​
FAQs

All three authenticate Gumloop to Snowflake, but differ in mechanism:
  • OAuth — browser-based login with short-lived, auto-refreshed tokens. Best for interactive/human users.
  • Key-Pair — RSA JWT authentication using a private key. Best for service users and MFA-enforced accounts, since it isn’t subject to an interactive MFA prompt.
  • PAT — a Programmatic Access Token used like a password. Simple, but tied to token expiry and network-policy rules.
Key-pair (JWT) authentication does not trigger an interactive MFA challenge, which is exactly why it’s recommended for service users and accounts where MFA is enforced for interactive logins. Restrict the associated Snowflake user to least-privilege roles.
An RSA private key in PEM (PKCS#8) format — the output of openssl pkcs8 -topk8. Both encrypted and unencrypted keys are supported. Line breaks are optional when pasting; Gumloop normalizes the formatting.
Only if you generated an encrypted private key (without -nocrypt). For unencrypted keys, leave the passphrase blank.
No — only one Snowflake Key-Pair credential can be configured per account.
Generate a new key pair, register the new public key on your Snowflake user with ALTER USER ... SET RSA_PUBLIC_KEY, then update the Private Key (and passphrase, if any) in your Gumloop credential. Snowflake also supports RSA_PUBLIC_KEY_2 for zero-downtime rotation.

​
Security Best Practices

Least Privilege

Connect as a Snowflake user with only the minimum roles and warehouse access your workflows need.

Encrypt the Private Key

Prefer an encrypted key with a passphrase over an unencrypted one.

Rotate Keys Regularly

Periodically rotate the key pair, using RSA_PUBLIC_KEY_2 for zero-downtime rotation.

Secure Storage

Never share the private key in plain text. Gumloop encrypts stored credentials.

​
Additional Resources

​
Need Help?

If you encounter issues not covered here:
  1. Review the Snowflake key-pair authentication documentation
  2. Contact your Snowflake administrator for account-specific issues
  3. Reach out to Gumloop Support for integration assistance