Snowflake Key Pair Authentication

[Fanz]

Hi there,

I am looking for some type of resource/guidance/ documentation in setting up a Snowflake Key Pair using the native snowflake connector > KeyPair option. I wold like to to this for both Desktop as well as Power BI Service but I am having trouble finding doccumentation on how to properly set this up. Can you please point me to the documentation?

[v-tsaipranay]

Hi @Fanz ,

We haven’t received an update from you in some time. Could you please let us know if the issue has been resolved?
If you still require support, please let us know, we are happy to assist you.

Thank you.

[v-tsaipranay]

Hi @Fanz ,

Thank you for reaching out to the Microsoft Fabric Community Forum. 

Could you please let us know if the issue has been resolved? I wanted to check if you had the opportunity to review the information provided by @Ritaf1983 . If you still require support, please let us know, we are happy to assist you.

Thank you.

[Ritaf1983]

Hi @Fanz 

To set up Snowflake Key Pair authentication using the native connector in Power BI (Desktop and Service), follow these steps based on current implementation standards:

1. Snowflake Configuration
Generate a 2048-bit RSA key pair and assign the public key to your Snowflake user.

Command to set the public key in Snowflake:

SQL

ALTER USER <username> SET RSA_PUBLIC_KEY='<MIIBIjANBg...>';
Note: Ensure you remove the "---BEGIN PUBLIC KEY---" and "---END PUBLIC KEY---" headers/footers and any line breaks when pasting the key into Snowflake.

2. Power BI Desktop Setup
The native Snowflake connector now includes a specific KeyPair tab in the authentication dialog.

Select Get Data > Snowflake.

Enter your Server and Warehouse.

In the authentication window, select KeyPair from the left-side menu.

Private Key Path: Provide the local file path to your private key file (e.g., C:\Keys\snowflake_key.p8).

Passphrase: Enter the password used to encrypt the private key.

3. Power BI Service Setup
After publishing the report, you must configure the credentials in the cloud environment.

Go to the Workspace and locate the Semantic Model.

Open Settings > Data source credentials > Edit credentials.

Set the Authentication Method to KeyPair.

Private Key: Instead of a file path, you must paste the entire content of your private key file (including the BEGIN/END headers).

Passphrase: Enter the associated password.

Note: If using an On-premises data gateway, ensure it is updated to the latest version to support the ADBC-based Snowflake connector.

Official Documentation
Snowflake Key-Pair Authentication: https://docs.snowflake.com/en/user-guide/key-pair-auth

Power BI Snowflake Connector: https://learn.microsoft.com/en-us/power-bi/connect-data/desktop-connect-snowflake

If this post helps, then please consider Accepting it as the solution to help the other members find it more quickly

[nganesh]

In the app.powerbi.com, there is no option to cut-n-paste. It only provides the option to upload the file. I am getting the error.

Failed to update data source credentials: ADBC: [Snowflake] 390144 (08004): JWT token is invalid.

[Fanz]

I had the same issue upon testing. For the local file, I had to paste in the full key including headers and footers. For app.powerbi.com. I had to select the file (with headres and footers) for upload. So the Key Pair instructions for item 2 & 3 in the instructions are swapped. 

[v-sshirivolu]

HI @Ritaf1983 ,

As per official Microsoft Fabric documentation, the private key should always be provided in the full PEM format, including the complete header and footer lines such as ----BEGIN PRIVATE KEY---- and ----END PRIVATE KEY----, or the encrypted version if necessary. In Power BI Desktop, you need to paste the entire key content including these headers and footers in the key field. In Power BI Service (app.powerbi.com), you should upload the private key file itself, and that file must also contain the full key with headers and footers. If your key is encrypted, then you also have to provide the passphrase. So basically, the key should always be complete, and the only difference is that in Desktop you paste the full key, whereas in Service you upload the full key file.

Refer these Microsoft official Docs -
Microsoft Fabric – Snowflake connector (Key-pair authentication):

https://learn.microsoft.com/en-us/fabric/data-factory/connector-snowflake

Power BI – Connect to Snowflake :
https://learn.microsoft.com/en-us/power-bi/connect-data/service-connect-snowflake

These documents confirm that the private key must be in full PEM format and explain how the connector expects the key to be provided.

Thank you.

[nganesh]

Also is it possible to update these values via API when a new workspace is being setup. 

[Fanz]

Thank you so very much for the detailed information. When trying to implement hit some issues internally and haven't yet been able to test end to end but provided the detail and documentation this should be sufficient. I appreicate the time you took to share. This is exactly what I was looking for.