If you are using Snowflake as your data warehouse, Toolio can integrate directly with your Snowflake instance. Toolio supports two connection methods: Direct Connection (Toolio connects to your Snowflake using credentials) or Snowflake Private Listing (you share data with Toolio's Snowflake account — no credentials required, fully self-service). Before you connect, review the Toolio Integration Guide for how Toolio's core data models work.

❗ Snowflake is retiring password authentication for service users. In the final phase of Snowflake's MFA rollout (August–October 2026), non-human users are blocked from signing in with a password and the LEGACY_SERVICE user type is fully deprecated. If your Toolio integration uses a Direct Connection with a password, switch it to key-pair authentication before your account is enforced, or your data syncs will stop. Private Listing connections are not affected.

Table Naming Conventions

You will need to set up a table for each core model. Below are the required table names:

Data Model	Table Name
Product	toolio_products
Inventory	toolio_inventory
Sale	toolio_sales
Purchase Order	toolio_purchase_orders
Receipt	toolio_receipts

Required Table Schema

You can think of each column on your table corresponding to an attribute on Toolio's data models. Column names should be the same as the slugs. Please see core model documentation for the column types you should use.

Direct Connection

With a Direct Connection, Toolio signs in to your Snowflake account as a dedicated user and reads your Toolio tables. Please share the following information with your Toolio Customer Success Manager:

.snowflakecomputing.com

user=

db=

schema=

warehouse=

role=

Toolio supports two ways to authenticate that user:

Key-pair authentication — you generate an RSA key pair, register the public key on your Snowflake user, and give Toolio the private key. This is the recommended method and the only one that will keep working once Snowflake enforces its service-user policy.
Password authentication — the legacy method. Snowflake is deprecating it for service users, so use it only if you are not yet able to move to key pairs.

Key-Pair Authentication

Key-pair authentication replaces the password on your Snowflake service user with an RSA key pair. You keep the public key on the Snowflake user and give Toolio the matching private key, which Toolio uses to sign in.

💡 Toolio requires an unencrypted private key. There is no passphrase field in the integration settings, so a passphrase-protected key cannot be used. If your security policy requires you to generate an encrypted key, decrypt a copy before sending it to Toolio — see the FAQs at the end of this article.

Step 1: Generate a Key Pair

On a machine with OpenSSL installed, generate an unencrypted private key. Snowflake requires a 2048-bit RSA key pair at minimum:

openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out rsa_key.p8 -nocrypt

Then generate the matching public key:

openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub

The -nocrypt flag is what makes the private key unencrypted. You should not be prompted for a passphrase, and rsa_key.p8 should begin with -----BEGIN PRIVATE KEY----- — not -----BEGIN ENCRYPTED PRIVATE KEY-----.

Step 2: Assign the Public Key to Your Snowflake User

In Snowflake, register the public key on the user Toolio connects with. Paste the contents of rsa_key.pub without the -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY----- delimiter lines:

ALTER USER TOOLIO_READ_USER SET RSA_PUBLIC_KEY='MIIBIjANBgkqh...';

If you are also moving the user to Snowflake's service user type, set that at the same time:

ALTER USER TOOLIO_READ_USER SET TYPE = SERVICE;

You can confirm the key was registered by checking that the fingerprint is populated:

DESC USER TOOLIO_READ_USER;

Look for the RSA_PUBLIC_KEY_FP property in the results.

Step 3: Send the Private Key to Toolio Securely

The private key is a credential, treat it like a password. Send rsa_key.p8 to your Toolio Customer Success Manager using our secure upload portal at toolio.sendsafely.com/dropzone/integrations (or a 1Password share). Do not send it over email or Slack.

If you manage the integration yourself, you can skip this step and enter the key directly in Toolio in Step 4.

Step 4: Enable Private Key Authentication in Toolio

In Toolio, navigate to Settings > Data Management > Integrations and open the Snowflake integration. With Connection Mode set to Direct:

Turn on the Private Key toggle. The Password field is replaced by a Private Key box.
Paste the entire contents of rsa_key.p8 into the Private Key box, including the -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY----- lines and all of the line breaks in between. Toolio validates the format on save, so the header and footer lines are required and the key cannot be flattened onto a single line.
Confirm Account, Username, Database Name, Schema Name, Warehouse, and Role are still correct.
Click Save.

Once saved, Toolio connects using the key pair instead of the password. Your next scheduled sync will use the new credentials — ask your Customer Success Manager to run a test sync if you want to confirm the switch immediately.

Snowflake Private Listing

Snowflake Private Listing allows you to share data from your Snowflake account directly with Toolio — no credentials required, and data never leaves Snowflake's platform. Toolio will mount your listing as a read-only database on our end.

Use Private Listing if:

Your security policy prohibits sharing Snowflake credentials with external parties.
You prefer to manage data access through Snowflake's native access controls.
You want to avoid credential rotation entirely — Private Listing is unaffected by Snowflake's password deprecation.

Step 1: Set Up Your Tables

Create the tables in your Snowflake schema following the Table Naming Conventions and Required Table Schema above. Note the schema name where these tables reside — you will need it in Step 4.

Step 2: Create a Private Listing in Snowflake

In your Snowflake account, navigate to Data Products > Provider Studio and create a new listing:

Select Only Specified Consumers to make it a private listing.
Add the schema containing your Toolio tables as the listing content.

Step 3: Add Toolio as a Consumer

Share your listing with Toolio's Snowflake account. Your Toolio Customer Success Manager will provide <TOOLIO_ACCOUNT>:

ALTER LISTING <LISTING_NAME> ADD TARGETS $$targets:  accounts: ["<TOOLIO_ACCOUNT>"]$$;

Then retrieve your listing's global name — this is the Listing ID you will enter in Toolio:

DESC LISTING <LISTING_NAME>;

Look for the global_name field in the results (e.g., GZ1MWZ2OYN3).

Step 4: Enter the Listing ID in Toolio

In Toolio, navigate to Settings > Data Management > Integrations and open the Snowflake integration. Select Private Listing as the connection mode, then:

Paste the global_name from the previous step into the Listing ID field.
Enter the schema name where your Toolio tables reside.

Pagination & UpdateAt Field

If possible, make sure to add an updatedAt field to each of the tables that you create. This helps Toolio keep track of the last value that has been synced from your Data Warehouse. To learn more please see how Toolio handles pagination here.

FAQs

How Do I Know Which Authentication Method My Integration Uses?

Open Settings > Data Management > Integrations and select the Snowflake integration. If Connection Mode is Private Listing, you are not using credentials at all and nothing needs to change. If it is Direct, check the Private Key toggle — when it is off, you are on password authentication and should migrate. Your Customer Success Manager can also confirm this for you.

Do I Have to Use an Unencrypted Private Key?

Yes. Toolio's Snowflake integration has no passphrase field, so it cannot open a passphrase-protected key. If you already have an encrypted key, decrypt a copy with OpenSSL and send that copy to Toolio:

openssl pkey -in encrypted_key.p8 -out decrypted_key.p8

You will be prompted for the passphrase. Keep the decrypted file out of source control and delete it once the key is loaded into Toolio.

Why Am I Seeing "Invalid Private Key" When I Save?

Toolio checks the key's format before saving and rejects anything that isn't an unencrypted PKCS#8 key. If you see:

Invalid private key. The specified value must be a string in pem format of type pkcs8

check the following:

The key starts with -----BEGIN PRIVATE KEY-----. If it says -----BEGIN ENCRYPTED PRIVATE KEY-----, the key has a passphrase and must be decrypted first. If it says -----BEGIN RSA PRIVATE KEY-----, it is in the older PKCS#1 format — regenerate it with the openssl pkcs8 -topk8 command in Step 1.
The key ends with -----END PRIVATE KEY----- on its own line, with nothing after it.
The line breaks are intact. Pasting the key as a single long line will fail.
You pasted the private key (rsa_key.p8), not the public key (rsa_key.pub).

Because this is checked when you save, a bad key is caught immediately rather than silently breaking your next sync.

Can I Rotate the Key Later?

Yes. Snowflake supports a second key so you can rotate without downtime — set RSA_PUBLIC_KEY_2 to your new public key, update the private key in Toolio, then remove the old key. See Snowflake's key-pair authentication guide for the full process.

Will My Syncs Break the Moment I Switch?

No. Registering a public key does not disable the existing password, so you can add the key in Snowflake first and update Toolio afterward. Once Toolio is saved with the private key, the password is no longer used and your Snowflake admin can remove it.

Snowflake Integration