1. Overview & Timeline
Starting in August 2026, authentication for Learn Data will move from username/password to key-pair authentication. This change affects all customers and all access methods — both interactive and programmatic.
| Important: Username/password authentication will be permanently disabled from the beginning of August 2026. Direct UI login will also no longer be available — DBeaver will be the suggested tool for interactive access. You must complete all steps in this guide before the deadline to avoid service interruption. |
What has changed
- UI login disabled: Direct browser-based access to Learn Data will no longer be supported. Tools like DBeaver can be used instead..
- Key-pair only: All authentication — both interactive (DBeaver) and programmatic (pipelines) — must use key-pair authentication.
- Docebo Contact involvement: Your Docebo representative must upload your public key to the system on your behalf.
Summary of steps
| # | Action | Who |
| 1 | Export Snowsight worksheets as .sql files | Customer |
| 2 | Generate a private/public key pair | Customer |
| 3 | Send the public key to your Docebo Contact | Customer → Docebo Contact |
| 4 | Upload the public key to Learn Data | Docebo Contact (Docebo) |
| 5 | Update automated pipelines to use key-pair auth | Customer |
| 6 | Install DBeaver and configure it for Learn Data access | Customer |
2. Step-by-Step Migration Process
2.1 - Export Your Snowsight Worksheets
Before the authentication change takes effect, export a local backup of all your Snowsight worksheets. This step is mandatory and must be completed before August 2026.
| Note: There is no bulk export option in Snowsight. Each worksheet must be downloaded individually as a .sql file. |
The full procedure is documented in the Snowsight Worksheet Export Guide (internal document). Follow the steps below:
| 1 | Migrate legacy worksheets to a Workspace |
Worksheets must be in the Workspaces section of Snowsight before they can be exported. If the migration was already done, skip to step 2.
- Sign in to Snowsight as ACCOUNTADMIN.
- In the lower-left corner, select your name, then Settings.
- Under Account, choose General.
- Enable "Set Workspaces as default SQL editor for the account".
Fig. 1 — The left panel shows legacy worksheets (bottom) and Workspaces section (top)
Reference: Snowflake BCR-2117 — Workspaces migration guide
| 2 | Identify the worksheets to export |
Once migration is complete, all worksheets appear in the Workspaces section of the left-hand panel. Review the list and note which worksheets you need to download.
Fig. 2 — Example workspace showing migrated worksheets alongside legacy ones
| 3 | Download each worksheet from the ellipsis menu |
For each worksheet you want to export:
- In the left panel, hover over the worksheet name.
- Click the … (ellipsis) icon that appears on the right.
- Select Download from the dropdown menu.
- The worksheet is saved as a .sql file to your local machine.
Fig. 3 — Hover over a worksheet name to reveal the ellipsis (…) menu
Fig. 4 — Select "Download" from the dropdown to save the worksheet as a .sql file
| 4 | Repeat for every worksheet you need |
| Tip: Keep a checklist of all worksheets you need to export. There is no way to download them all at once. |
2.2 - Generate Your Key Pair
You need to generate a private key and a public key using OpenSSL. The private key stays on your machine; the public key will be shared with your Docebo Contact.
| Prerequisite: OpenSSL must be installed on your machine. If you do not have it, refer to Appendix A (Windows) or Appendix B (macOS) before proceeding. |
| 1 | Generate the private key |
Open a terminal and run:
| openssl genrsa 2048 | openssl pkcs8 -topk8 -nocrypt -inform PEM -out rsa_key.p8 |
This creates rsa_key.p8 in your current directory. Move it to a secure, non-public location (e.g., ~/LD_Keys/).
| 2 | Generate the public key |
Extract the public key from the private key:
| openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub |
This creates rsa_key.pub. This is the file you will send to your Docebo Contact. Never share rsa_key.p8.
| Security reminder: Never share your private key file (rsa_key.p8) with anyone, including Docebo staff. Only the public key (rsa_key.pub) should be shared. |
2.3 - Share the Public Key with Your Docebo Contact
Send the public key file (rsa_key.pub) to your Docebo Contact at Docebo.
Your Docebo Contact will upload the public key to Learn Data and confirm when your account is configured. They will also provide you with the Server URL and Username needed to configure DBeaver.
| Note: Do not proceed with DBeaver configuration or pipeline updates until your Docebo Contact has confirmed that the public key has been successfully uploaded. |
2.4 - Update Automated Pipelines
If you have any automated pipelines (ETL jobs, scripts, scheduled queries, or any other programmatic integrations) that connect to Learn Data, you must update them to use key-pair authentication before August 2026.
The official Snowflake reference for implementing key-pair authentication in code: docs.snowflake.com/en/user-guide/key-pair-auth.
- Connection config: Replace username/password parameters with the path to your private key file and your username.
- Connector/driver: Ensure your Snowflake connector or JDBC/ODBC driver supports key-pair authentication.
- Private key path: The private key file must be accessible from the environment where your pipeline runs.
- Testing: Test each pipeline before the cutover date to verify the new authentication works correctly.
| Important: All automated pipelines must be updated and tested before August 2026. After that date, any connection using username/password will fail. |
2.5 - Configure DBeaver for UI Access
Since direct browser-based UI access will be disabled, alternative tools may be used for interactive access to Learn Data; however, DBeaver is the recommended tool in this guide.
This section is based on the DBeaver Configuration for Learn Data guide (internal document, v1.0, 13 May 2026).
Additional reference: Using Private Key authentication in DBeaver (Snowflake Community).
One-Time Setup
- Download and install DBeaver Community Edition from dbeaver.io.
- Create a local folder to store your private key file in a secure, non-public location:
macOS: /Users/yourname/LD_Keys/
Windows: C:\Users\yourname\LD_Keys\
- Copy your rsa_key.p8 private key file into that folder.
Per-Connection Setup
Follow these steps each time you configure a new Learn Data connection in DBeaver:
| 1 | Create a new connection |
- Press Ctrl+Shift+N (Windows) or ^⇧N (macOS), or right-click the Database panel and select Create > Connection.
Right-click the Database panel and select Create > Connection
- Search for Snowflake and select it.
Search for "Snowflake" and select the connector
- If prompted, click Download to install the Snowflake JDBC driver automatically.
|
⚠️ At this point or slightly later, at the first connection ever that you create, DBeaver will ask you to install an additional package for the JDBC drivers: Choose ”Download” to let the system install the appropriate driver automatically. |
Click Download to install the Snowflake JDBC driver
| 2 | Fill in the Main tab |
- Set Host to the Server URL provided by your Docebo Contact.
- Set Username to the username provided by your Docebo Contact.
- Clear the Database field (remove any pre-filled value).
- Leave Password empty.
Fill in Host and Username in the Main tab; leave Password empty
| 3 | Add the private key in Driver Properties |
- Switch to the Driver Properties tab.
- Click Add property at the bottom.
- Set property name: private_key_file
- Set the value to the full path of your rsa_key.p8 file, for example:
| /Users/yourname/LD_Keys/rsa_key.p8 |
Add the private_key_file property pointing to your rsa_key.p8 file
| 4 | Test and finalise the connection |
- Click Test Connection… at the bottom left. A success message confirms the connection is working.
A successful connection test shows server version and driver information
- Switch back to the Main tab and fill in the remaining fields using the dropdown lists:
- Database — select your assigned database
- Warehouse — select your assigned warehouse
- Schema — select your assigned schema
Complete the Main tab by selecting Database, Warehouse, and Schema from the dropdowns
- Click Finish to save the connection.
Appendix A - Installing OpenSSL on Windows
OpenSSL is not included with Windows by default. Choose one of the options below.
Option 1 - Using winget
Open PowerShell or Command Prompt as Administrator and run:
| winget install -e --id ShiningLight.OpenSSL |
Verify:
| openssl version |
Option 2 - Using Chocolatey
If you have Chocolatey installed, run in an elevated PowerShell:
| choco install openssl |
Option 3 - Pre-built Binary
- Visit slproweb.com/products/Win32OpenSSL.html and download the Win64 OpenSSL v3.x.x Light installer from ‘Download Win32/Win64 OpenSSL’ section.
- Run the installer; select Copy OpenSSL DLLs to the OpenSSL binaries directory.
- Add the bin folder (e.g., C:\Program Files\OpenSSL-Win64\bin) to your system PATH via System Properties > Environment Variables.
- Restart any open terminals, then verify: openssl version
Appendix B - Installing OpenSSL on macOS
macOS ships with LibreSSL. For key generation it is recommended to use the full OpenSSL distribution via Homebrew.
Using Homebrew
Install Homebrew from brew.sh if not already installed:
| /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" |
Install OpenSSL:
| brew install openssl@3 |
Add OpenSSL to your PATH (~/.zshrc or ~/.bash_profile):
| export PATH="$(brew --prefix openssl@3)/bin:$PATH" |
Reload and verify:
|
source ~/.zshrc openssl version |
| Expected output: OpenSSL 3.x.x ... (Library: OpenSSL 3.x.x ...) |
Appendix C - Reference Links
| Resource | URL |
| Snowsight Worksheet Export Guide | https://drive.google.com/file/d/1DOTGuu1kJf0fqGKaw1lPT_xwauVfteNf/view |
| DBeaver Configuration for Learn Data | https://docs.google.com/document/d/1AZGQ57McyDqyW7LkJ4pEXt__OYYOKafRVy3HlJ2vvxg/edit |
| Snowflake Key-Pair Authentication | https://docs.snowflake.com/en/user-guide/key-pair-auth |
| Snowflake BCR-2117 (Workspaces Migration) | https://docs.snowflake.com/en/release-notes/bcr-bundles/un-bundled/bcr-2117 |
| DBeaver Download | https://dbeaver.io/ |
| Private Key Auth in DBeaver (Snowflake Community) | https://community.snowflake.com/s/article/Using-Private-Key-authentication-in-DBeaver |
| OpenSSL Windows Installer | https://slproweb.com/products/Win32OpenSSL.html |
| Homebrew (macOS) | https://brew.sh/ |