1. Overview & Timeline

Starting in August 2026, authentication for Learn Data will move from username/password to key-pair authentication. This change affects all customers and all access methods — both interactive and programmatic.

What has changed

• UI login disabled: Direct browser-based access to Learn Data will no longer be supported. Tools like DBeaver can be used instead..
• Key-pair only: All authentication — both interactive (DBeaver) and programmatic (pipelines) — must use key-pair authentication.
• Docebo Contact involvement: Your Docebo representative must upload your public key to the system on your behalf.

Summary of steps

2. Step-by-Step Migration Process

2.1 - Export Your Snowsight Worksheets

Before the authentication change takes effect, export a local backup of all your Snowsight worksheets. This step is mandatory and must be completed before August 2026.

The full procedure is documented in the Snowsight Worksheet Export Guide (internal document). Follow the steps below:

Worksheets must be in the Workspaces section of Snowsight before they can be exported. If the migration was already done, skip to step 2.

• Sign in to Snowsight as ACCOUNTADMIN.
• In the lower-left corner, select your name, then Settings.
• Under Account, choose General.
• Enable "Set Workspaces as default SQL editor for the account".

Fig. 1 — The left panel shows legacy worksheets (bottom) and Workspaces section (top)

Reference: Snowflake BCR-2117 — Workspaces migration guide

Once migration is complete, all worksheets appear in the Workspaces section of the left-hand panel. Review the list and note which worksheets you need to download.

Fig. 2 — Example workspace showing migrated worksheets alongside legacy ones

For each worksheet you want to export:

1. In the left panel, hover over the worksheet name.
2. Click the … (ellipsis) icon that appears on the right.
3. Select Download from the dropdown menu.
4. The worksheet is saved as a .sql file to your local machine.

Fig. 3 — Hover over a worksheet name to reveal the ellipsis (…) menu

Fig. 4 — Select "Download" from the dropdown to save the worksheet as a .sql file

2.2 - Generate Your Key Pair

You need to generate a private key and a public key using OpenSSL. The private key stays on your machine; the public key will be shared with your Docebo Contact.

Open a terminal and run:

This creates rsa_key.p8 in your current directory. Move it to a secure, non-public location (e.g., ~/LD_Keys/).

Extract the public key from the private key:

This creates rsa_key.pub. This is the file you will send to your Docebo Contact. Never share rsa_key.p8.

2.3 - Share the Public Key with Your Docebo Contact

Send the public key file (rsa_key.pub) to your Docebo Contact at Docebo.

Your Docebo Contact will upload the public key to Learn Data and confirm when your account is configured. They will also provide you with the Server URL and Username needed to configure DBeaver.

2.4 - Update Automated Pipelines

If you have any automated pipelines (ETL jobs, scripts, scheduled queries, or any other programmatic integrations) that connect to Learn Data, you must update them to use key-pair authentication before August 2026.

The official Snowflake reference for implementing key-pair authentication in code: docs.snowflake.com/en/user-guide/key-pair-auth.

• Connection config: Replace username/password parameters with the path to your private key file and your username.
• Connector/driver: Ensure your Snowflake connector or JDBC/ODBC driver supports key-pair authentication.
• Private key path: The private key file must be accessible from the environment where your pipeline runs.
• Testing: Test each pipeline before the cutover date to verify the new authentication works correctly.

2.5 - Configure DBeaver for UI Access

Since direct browser-based UI access will be disabled, alternative tools may be used for interactive access to Learn Data; however, DBeaver is the recommended tool in this guide.

Additional reference: Using Private Key authentication in DBeaver (Snowflake Community).

One-Time Setup

5. Download and install DBeaver Community Edition from dbeaver.io.
6. Create a local folder to store your private key file in a secure, non-public location:

macOS: /Users/yourname/LD_Keys/

Windows: C:\Users\yourname\LD_Keys\

7. Copy your rsa_key.p8 private key file into that folder.

Per-Connection Setup

Follow these steps each time you configure a new Learn Data connection in DBeaver:

• Press Ctrl+Shift+N (Windows) or ^⇧N (macOS), or right-click the Database panel and select Create > Connection.

Right-click the Database panel and select Create > Connection

• Search for Snowflake and select it.

Search for "Snowflake" and select the connector

• If prompted, click Download to install the Snowflake JDBC driver automatically.

Click Download to install the Snowflake JDBC driver

• Set Host to the Server URL provided by your Docebo Contact.
• Set Username to the username provided by your Docebo Contact.
• Clear the Database field (remove any pre-filled value).
• Leave Password empty.

Fill in Host and Username in the Main tab; leave Password empty

• Switch to the Driver Properties tab.
• Click Add property at the bottom.
• Set property name: private_key_file
• Set the value to the full path of your rsa_key.p8 file, for example:

Add the private_key_file property pointing to your rsa_key.p8 file

• Click Test Connection… at the bottom left. A success message confirms the connection is working.

A successful connection test shows server version and driver information

• Switch back to the Main tab and fill in the remaining fields using the dropdown lists:

• Database — select your assigned database
• Warehouse — select your assigned warehouse
• Schema — select your assigned schema

Complete the Main tab by selecting Database, Warehouse, and Schema from the dropdowns

• Click Finish to save the connection.

Appendix A - Installing OpenSSL on Windows

OpenSSL is not included with Windows by default. Choose one of the options below.

Option 1 - Using winget

Open PowerShell or Command Prompt as Administrator and run:

Verify:

Option 2 - Using Chocolatey

If you have Chocolatey installed, run in an elevated PowerShell:

Option 3 - Pre-built Binary

• Visit slproweb.com/products/Win32OpenSSL.html and download the Win64 OpenSSL v3.x.x Light installer from ‘Download Win32/Win64 OpenSSL’ section.
• Run the installer; select Copy OpenSSL DLLs to the OpenSSL binaries directory.
• Add the bin folder (e.g., C:\Program Files\OpenSSL-Win64\bin) to your system PATH via System Properties > Environment Variables.
• Restart any open terminals, then verify: openssl version

Appendix B - Installing OpenSSL on macOS

macOS ships with LibreSSL. For key generation it is recommended to use the full OpenSSL distribution via Homebrew.

Using Homebrew 

Install Homebrew from brew.sh if not already installed:

Install OpenSSL:

Add OpenSSL to your PATH (~/.zshrc or ~/.bash_profile):

Reload and verify:

Appendix C - Reference Links