Skip to main content

Snowflake: Revoking Triple Whale's Access

Learn how to disconnect your Snowflake integration, understand what happens to exported data, and reconnect when you’re ready.

Written by Andrea

Snowflake: Revoking Triple Whale's Access

Connection method

What Triple Whale holds

How to revoke it

Username/Password

A Snowflake user's password

Change the password, or disable or drop the user

PAT (Programmatic Access Token)

A token issued to triplewhale_integration

Remove the token, then optionally drop the user, role and policy

Key pair

The private key matching a public key on your Snowflake user

Remove the public key from your user, or replace it with a new one

Not sure which you used? In Snowflake, run SHOW USERS LIKE 'triplewhale_integration';.

If that user exists, you most likely connected with a PAT. If DESC USER <your_username>; shows a value for RSA_PUBLIC_KEY_FP, you connected with a key pair.

Exported data stays.

  • Tables Triple Whale already wrote stay in your database and schema. Drop them separately if you want them gone.

Step 1: Stop scheduled exports to Snowflake

Do this before you revoke any credentials. Otherwise scheduled runs keep firing and fail, which can flood your team with error alerts.

  1. Find every export that writes to Snowflake. In Triple Whale, go to Data -> Data Warehouse Export -> Configuration.

  2. Delete each configuration where provider = Snowflake

  3. DELETE the integration. Go to Data > Integrations, find Snowflake, and click the 3 dots next to the integration name, then click Delete. This deletes the stored credentials from Triple Whale.

Step 2a: If you connected with Username/Password

Triple Whale stored a Snowflake username and password, so there's no separate token to delete. Make that password stop working.

If you used your personal or a shared Snowflake user, change its password. You can also do this in Snowsight under your user profile. Then update the password in any other tools that use this user.

ALTER USER <your_username> SET PASSWORD = '<new_strong_password>';

If you created a user just for Triple Whale, disable it or drop it:

-- Blocks new logins and aborts running queries: ALTER USER <username> SET DISABLED = TRUE;  -- Or remove the user entirely: DROP USER <username>;

Step 2b: If you connected with a Programmatic Access Token (PAT)

Run these as the role that created the setup objects, or as ACCOUNTADMIN.

  1. Revoke the token. Once you run this, the token can no longer be used.

ALTER USER triplewhale_integration REMOVE PROGRAMMATIC ACCESS TOKEN tw_export_token;

  1. Check that it's gone. tw_export_token should no longer be listed.

SHOW USER PROGRAMMATIC ACCESS TOKENS FOR USER triplewhale_integration;

  1. Optional: remove everything the setup created.

ALTER USER triplewhale_integration UNSET AUTHENTICATION POLICY; DROP AUTHENTICATION POLICY triplewhale_pat_policy; DROP USER triplewhale_integration; DROP ROLE TW_INTEGRATION_ROLE;

If DROP AUTHENTICATION POLICY can't find the policy, first run USE DATABASE and USE SCHEMA for the database and schema where you created it.

Step 2c: If you connected with a key pair

The Key Pair setup guide registers the public key on your own Snowflake user. Don't drop that user. Remove or replace the key instead.

Revoke access (no replacement)

  1. Remove the public key from your user. Once it's removed, Triple Whale's copy of the private key stops working. If you also set a second key, remove that one too.

ALTER USER <your_username> UNSET RSA_PUBLIC_KEY; ALTER USER <your_username> UNSET RSA_PUBLIC_KEY_2;

  1. Verify. Both RSA_PUBLIC_KEY_FP and RSA_PUBLIC_KEY_2_FP should show null.

DESC USER <your_username>;

  1. Delete the private key file. The setup guide creates it unencrypted, with no passphrase, so delete it from every machine you saved it to.

rm ~/snowflake-keys/rsa_key.p8 ~/snowflake-keys/rsa_key.pub

Replace the key (keep exports running)

A Snowflake user can have two public keys at once. That lets you add the new key, switch Triple Whale to it, then remove the old one without breaking exports.

  1. Generate a new key pair. Use new file names so you don't overwrite the current key.

cd ~/snowflake-keys openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out rsa_key_new.p8 -nocrypt openssl rsa -in rsa_key_new.p8 -pubout -out rsa_key_new.pub grep -v "PUBLIC KEY" rsa_key_new.pub | tr -d '\n'; echo

  1. Register the new public key as the second key. Use the single-line output from the last command.

ALTER USER <your_username> SET RSA_PUBLIC_KEY_2='<new-one-line-public-key>';

  1. Update Triple Whale. Go to Data > Integrations > Snowflake and replace the Private Key with the full contents of rsa_key_new.p8, including the BEGIN and END lines . Click Save.

  2. Test it. Run a Snowflake Workflow on demand and confirm the data arrives.

  3. Remove the old key:

ALTER USER <your_username> UNSET RSA_PUBLIC_KEY; DESC USER <your_username>;  -- only RSA_PUBLIC_KEY_2_FP should be set

  1. Delete the old files: rsa_key.p8 and rsa_key.pub.

The setup guide's own rotation method overwrites RSA_PUBLIC_KEY directly. That also works, but exports fail until you paste the new private key into Triple Whale.

Reconnection Steps

Once you’ve replaced your credentials and revoked the old ones in Snowflake, reconnect your integration in Triple Whale using your new password, programmatic access token (PAT), or private key.

Follow the instructions for your connection method in our Snowflake Integration guide.

After saving and confirming the connection works, turn your Snowflake export Workflows back on.

Related Articles
Did this answer your question?