Migrate to Key-Pair Authentication

Who needs to do this

Snowflake no longer supports single-factor password authentication as of Nov 2025, and Revefi connects to Snowflake using key pair authentication only.

If your Revefi Snowflake connection was set up with a username and password, follow the steps below to move it to key-pair authentication. Connections that already use a private key need no action.

📘

Nothing changes in your Snowflake permissions

This only changes how the Revefi user signs in. The role, warehouse, and grants from the setup guide stay as they are.

Step 1: Generate an RSA key pair

Run these commands on a machine you trust, and store both files securely.

For an unencrypted private key:

openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out rsa_key.p8 -nocrypt
openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub

For an encrypted private key (you will be prompted for a passphrase — keep it, you will need it in Step 3):

openssl genrsa 2048 | openssl pkcs8 -topk8 -v2 des3 -inform PEM -out rsa_key.p8
openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub

rsa_key.pub is the public key you register on Snowflake. rsa_key.p8 is the private key you enter into Revefi.

Step 2: Add the public key to your Revefi Snowflake user

As a user with ACCOUNTADMIN (or ownership of the Revefi user), run the following in a Snowflake worksheet. Replace REVEFI_USER with the username configured in your Revefi connection.

-- Paste the contents of rsa_key.pub as a single line, with the
-- '-----BEGIN PUBLIC KEY-----' and '-----END PUBLIC KEY-----' delimiters
-- and all line breaks removed, e.g. 'MIIBIjANBgkqh...'
ALTER USER REVEFI_USER SET RSA_PUBLIC_KEY='<RSA_PUBLIC_KEY>';

Verify that the key was registered — RSA_PUBLIC_KEY_FP should now hold a fingerprint:

DESC USER REVEFI_USER;

The password stays active at this point, so Revefi keeps collecting while you finish the remaining steps.

Step 3: Update the connection in Revefi

1. In Revefi, go to Connections on the left nav and click Edit on your Snowflake connection.
2. In Private key, paste the full contents of rsa_key.p8, including the -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY----- lines.
3. In Private key passphrase, enter the passphrase if you generated an encrypted key. Leave it blank for an unencrypted key.
4. Save the connection. Revefi validates the credentials on save, so a successful save confirms key-pair auth is working.

Step 4: Remove the password

Once the connection saves successfully, drop the password from the Revefi user and mark it as a service account so it is exempt from MFA policies:

ALTER USER REVEFI_USER UNSET PASSWORD;
ALTER USER REVEFI_USER SET TYPE = SERVICE;

Rotating keys later

Snowflake supports two public keys per user so you can rotate without downtime: register the new key as RSA_PUBLIC_KEY_2, update the private key in Revefi, then unset the old key.

ALTER USER REVEFI_USER SET RSA_PUBLIC_KEY_2='<NEW_RSA_PUBLIC_KEY>';
-- after updating the private key in Revefi and confirming the connection saves
ALTER USER REVEFI_USER UNSET RSA_PUBLIC_KEY;

Troubleshooting

"JWT token is invalid" — the private key in Revefi does not match the public key on the Snowflake user. Confirm the fingerprint from DESC USER REVEFI_USER matches your key pair:

openssl rsa -pubin -in rsa_key.pub -outform DER | openssl dgst -sha256 -binary | openssl enc -base64

"Failed to decrypt private key" — the passphrase is missing or wrong. Re-enter it in Private key passphrase, or leave the field blank if the key is unencrypted.

The account identifier is rejected — see Finding your Snowflake Account ID.

Still stuck? Reach out to