The Snowflake Python connector documents username and password, connection profiles, SSO, MFA, key pair, OAuth, workload identity federation and programmatic access tokens. For unattended pipelines, methods without a stored long lived password, such as key pair, OAuth or workload identity, fit better than a shared password.
The documented options
| Method | How it works in the docs | Fit for unattended jobs |
|---|---|---|
| Username and password | Pass user, password and account; can come from environment variables or a config file | Possible, but a long lived secret |
| connections.toml | Named profiles hold credentials and settings | Convenient; protect the file |
| SSO | Available if Snowflake is configured for it | Interactive by nature |
| MFA | Duo push, passcode, or token caching | Interactive; caching is on by default |
| Key pair | Set the authenticator to the JWT type and supply a private key file | Good for service accounts |
| OAuth | Token, or authorization code or client credentials flows | Good where an identity provider exists |
| Workload identity federation | Short lived credentials from AWS, Azure, GCP or OIDC | Strong fit: no stored long lived secret |
| Programmatic access token | Needs the feature enabled for the account | Non interactive |
Reading the table for a pipeline
A scheduled dbt or Airflow job has no human to approve a push or type a code. That rules out interactive methods. Of the rest, the docs describe workload identity federation as obtaining short lived credentials from the platform's identity provider, so no long lived secrets are stored. That removes the most common leak: a password in a repo, image or log.
Secrets handling
The docs recommend reading credentials from environment variables or configuration files instead of embedding them in code. Go a step further:
- Fetch at run time from your secrets manager, not at build time.
- Keep key files out of images and mount them as secrets.
- Use one identity per pipeline, so access and revocation are targeted.
- Grant the narrowest role. See warehouse role design.
- Log the identity of each connection for audit logging on warehouse access.
- Rotate keys on a schedule and when staff change.
A few details to watch
Token caching for MFA, SSO and OAuth is on unless you turn it off, according to the docs. On a shared machine, decide whether you want cached tokens. Some older parameter names are deprecated and emit warnings, so read warnings in your logs during upgrades.
Checking the connector itself
The connector is a dependency like any other. Pin its version, and track advisories for it and for its own dependencies. See Python dependency pinning in data projects and the Airflow provider advisories for how connector issues surface.
Quick check
Is key pair authentication better than a password for a job?
It avoids sending a password and suits service accounts, but the private key is still a secret. Store and rotate it carefully.
Can I hard code credentials for a quick test?
The docs advise using environment variables or configuration files instead of embedding credentials in code.
Safeguard scans the connectors and libraries your pipelines import, with a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
