Can't get Snowflake bulk uploder to work with new key-pair authentication to AWS

I'm trying to get the snowflake bulk uploader to work with snowflake key-pair authentication, and just can't make it work. Is anyone doing this? I can't find any decent documentation to describe how to do it, and no matter what I do within the interface, I can't get it to stick. I have no problem getting snowflake input and output connectors to work with the key-pair, but the output is far too slow for our needs and we need bulk uploading to work with key-pair.

The problem is when I get to the screen to pick my connections:

Screenshot 2025-10-30 153056.png

When I click the snowflake Bullk connection button, the only optoin it gives me is for username/password, but I need key-pair

Screenshot 2025-10-30 153157.png

Can anyone help? Does any step-by-step documentation exist for this?

Thanks!

Developer Tools

Tips and Tricks

Database Connection

Accepted answers

All comments

jrlindem

The method I use to handle credentials for snowflake is to use the ODBC Admin panel on my PC and then configured a Snowflake Driver connection that gets used by Alteryx. In this way I'm not using DCM. I'm not sure if that's helpful, but you're right finding good documentation on this is hard to find.

SPetrie

I believe DCM is the recommended method for storing the info, but you can use ODBC as well which is what we currently use. I found this one from Alteryx which gives their suggested setup.

pozzyal

Unfortunately, DCM doesn't appear to work for this function, unless I'm missing something. We'd prefer to use it, all the options are available in the GUI, this just seems like a bug, but I'm hoping someone has found a way. What do you mean you "use ODBC as well"? How/where do you configure the S3 bucket keys in ODBC?

jrlindem

@pozzyal you don't configure them in the S3 bucket. They contain the "instructions" for connecting in the same way you would configure or connect via other systems. You setup the configuration identifiers like (below) and then call for that connection in Alteryx.

So it uses those instructions to connect. In red you can see I'm using externalbrowser for authentication, but the server address in yellow is how it knows where to connect.

pozzyal

Yes, but isn't this just the connection to Snowflake, not the 2nd connection needed to AWS for bulk upload? I need to get it to take both these values, but can't figure out how or where. My snowflake authentication is fine, it's bulk upload that I can't make work. Does that make sense? A co-worker said he was just able to make it work by coding the odbc string directly, but we should be able to use the Alteryx interface as designed.

Screenshot 2025-10-30 153056.png

SPetrie

Are you on 2024.1 or newer? I believe Keypair is only supported inside Alteryx from 2024.1 and onward.

If you have one of the newer snowflake ODBC drivers installed, you can setup the key file directly in the ODBC config.

The setup you show in your original screenshot is attempting to use DCM, but this method would not use that, so you need to uncheck use DCM and point it to the ODCB connection that has the keypair configured.

If you want to use DCM and have 2024.1 or newer, you need to create your credentials in the DCM and use Snowflake Key-Pair as the credential type

Once you have that created you can link it to a data source for Snowflake Bulk using the staging method you prefer.

pozzyal

It still doesn't work with DCM, when you go to connect the credentials, the only option available is username/pw, there's no way to use the key-pair. This appears to be a bug. As a workaround we can do it once not using DCM and then just copy the connection string, as it would be ridiculous to have to re-configure this thing every time we want a new connection, and DCM can't seem to save it. I am using 2024.1

pozzyal

@jrlindem If you're not using DCM, does that mean there's no way to save this connection? That appears to be the case to me, which makes this incredibly clunky. Do you have a workable solution for each time you add a new connector? In theory we can just copy/paste an existing one, but that's not ideal, I'd prefer a clean way to set up a connection and re-use it as it's deisgned to do. Thanks!

dataguyW

We just went through all of this. We upgraded to 2024.2 to be above the version and I tested out the Key/Pair method. All worked fine using Gallery connection as setup above. The main issue is that all users must have access to the file location and file that holds the passphrase. It can work just fine. There is also a new method that can be used within SnowFlake as well called a Programmatic Access Token (PAT) that to the naked eye looks just like an incredibly long password (paragraph) and simply replaces the password. It locks down to network filtering rules, and to 1 and only 1 Role. This makes cutting away from older methods easier as there is no change for the developers or odbc updates. Just throwing another idea out there if you run into a jam on this.

pozzyal

@dataguyW Are you using bulk upload too? We have no problem getting the key-pair connection to work on the Gallery, it's the bulk upload piece that's not working, as we can't create/save a connection which contains the snowflake key-pair credentials as well as the AWS bucket/secret/etc., as this screen in the DCM GUI isn't working - it only gives the option for username/password credentials, rather than key-pair.

Screenshot 2025-10-30 153056.png

dataguyW

We do use the bulk uploader, but are now using just simple "gallery" connections vs. DCM. When I did key/value pair as a test I created the ODBC entry and set Authenticator=SNOWFLAKE_JWT. Your results may vary whether you are on Simba drivers or DSII Snowflake drivers. Don't quote me but I believe the JWT_TIMEOUT is also needed. None of these show up on the configuration screen. Also, after spending two weeks on all of this my DBA told me today they extended the date at Snowflake to October 2026 so don't fear, you have time

In my case my server, warehouse, database, role.etc. is in my ODBC conneciton settings. From the Gallery connection string I pass in the new components.

odbc:DSN=[YOUR DSN NAME];UID=[YOUR USER];PRIV_KEY_FILE=[YOUR PATH TO KEY FILE];PRIV_KEY_FILE_PWD=[YOUR PASSPHRASE];JWT_TIMEOUT=120

Out of the box there is no place for the new required settings. I believe you can add them as new registry entries and did a quick copilot search on how to find that and how to add new entries. It isn't bad, but I didn't want all my users doing this which is why we opted for the PAT method.

🔑 Required Registry Entries

Add the following String Values under your DSN key:

PRIV_KEY_FILE
- Value: Full path to your private key file (e.g., C:\Keys\rsa_key.p8)
PRIV_KEY_FILE_PWD
- Value: Your passphrase (as plain text)
AUTHENTICATOR
- Value: SNOWFLAKE_JWT (required for key pair authentication)
(Optional) LogLevel
- Value: 6 (for debugging purposes)

I was also given these two general links by a contact at Alteryx:

https://help.alteryx.com/current/en/designer/data-sources/snowflake.html#idp407338

https://community.alteryx.com/t5/Engine-Works/Impact-of-Snowflake-s-MFA-by-Default-for-New-Accounts-Policy-on/ba-p/1369714#:~:text=Alteryx%20supports%20both%20authentication%20types:%20*%20Designer,*%20Analytics%20Cloud.%20External%20OAuth%20(help%20link)

pozzyal

Are you also using Bulk Upload? That's the piece of the puzzle which is causing problems, as the Alteryx GUI doesn't offer a way to enter the AWS bucket/secret credentials or save the connection. We can make the functionality work if we don't use DCM, but then we have to either copy/paste the odbc string every time we need a new output tool, or we have to re-enter everything, since DCM can't save it. We want users to be able to just select the tool and then the connection and be off and running, rather than having to configure this every time.

dataguyW

It does also work with the Alteryx Output tool, connecting via a "Gallery" connection and having that tool set to Snowflake Bulk Loader in the ODBC options. I just created a quick table and loaded using SNOWBL. Are you using a specific Tool or just the Alteryx output tool? If you are using DCM and the new key/pair is not saving with the tool, you may want to consider the Programmatic Access Token method (PAT). It IS considered one of Snowflake's stronger authentication methods and whatever you could do before with a password+DCM would still continue to work since you replace what you woudl have entered as the password with the new token. It gets saved into your DCM connection details and behaves exactly like a simple user/pass to Alteryx. Snowflake understands when you login which method you are using automatically.

dataguyW

In my opinion, these types of issues are exactly why SnowFlake had to back down from the November 2025 deadline. You can't expect (aka force) all companies to modify all of their code for your own security shortfalls and the PAT was born.

pozzyal

If anyone like @dataguyW is interesting or following this discussion, I had a long call today with Alteryx and they were able to see my dilema and are going back to the shop to work on it and will report back in 24 - 48 hours. The goal is to be able to use DCM to configure and save the connection so that end users have a simple way to use Snowflake Bulk upload. The functionality does exist, it can be manually configured without using DCM, but that is not a long-term solution.

AlexApolloni

@pozzyal did you have any luck with a response from Alteryx?

pozzyal

@AlexApolloni They're still working on it. Will post back here when it's resolved or I have any meaningful updates. Seems pretty clear that it's a bug.

dataguyW

It is always good to have all the possibilities available. It does seem that SnowFlake allows multiple authentication methods, so you could convert everything you can to key/pair and have a PAT created until the bug is fixed. I know it isn't exactly what you are looking for, but there is a path depending on how long it takes to turn around the bug. Options are always good.

Quick Links

This months top contributors

atcodedog05 19458

Qiu 15866

binu_acs 15708

MarqueeCrew 13708

apathetichell 13703