snowflake-cloud-data-platform

How to retrieve Secrets (e.g., API keys) in Snowflake Notebooks


I am currently trying out Snowflake Notebooks (in preview). I could not find any information on how to handle secrets, such as API keys.

I know I can create secrets in Snowflake, but I can't figure out how to access them from a Notebook. There is nothing on this in the Notebook documentation.

In the Secret API reference there is a description on how "to retrieve credentials contained in a secret you created", but I cannot make this work in a Snowflake Notebook.

Any hints are greatly appreciated.


Solution

  • I had the same issue for retrieving username and password secrets object, my workaround was to create a function to retrieve the secret and then call it in my notebook. Adapt this code to use API keys.

    First create an integration:

    CREATE OR REPLACE EXTERNAL ACCESS INTEGRATION my_external_endpoints
    ALLOWED_AUTHENTICATION_SECRETS = ('database.schema.your_secret_string_name')
    ENABLED = true;
    

    Then create this function that will retrieve the info for you:

    CREATE OR REPLACE FUNCTION get_secret_username_password()
    RETURNS STRING
    LANGUAGE PYTHON
    RUNTIME_VERSION = 3.8
    HANDLER = 'get_secret_username_password'
    EXTERNAL_ACCESS_INTEGRATIONS = (my_external_endpoints)
    SECRETS = ('cred' = your_secret_string_name)
    AS
    $$
    import _snowflake
    import json
    
    def get_secret_username_password():
      username_password_object = _snowflake.get_username_password('cred')
    
      username_password_dictionary = {
          "Username": username_password_object.username,
          "Password": username_password_object.password
      }
    
      return json.dumps(username_password_dictionary)
    $$;
    

    In your notebook retrieve the info:

    from snowflake.snowpark import Session
    import json
    
    session = get_active_session()
    
    result = session.sql(f"""
        SELECT get_secret_username_password()
    """).collect()
    
    creds = json.loads(result[0][0])
    
    username = creds["Username"]
    password = creds["Password"]