Connect Excel for Mac to Snowflake with a private key

Connecting Excel for Mac to Snowflake takes more than generating a private key. Excel also needs to load the right ODBC driver, find the named connection, and read the key file from a location it can access.

This guide covers Excel desktop for Mac, Microsoft Query, and Snowflake ODBC key-pair authentication. It is a documentation-based setup guide, not a report of a completed Mac installation. Validate the exact Excel and driver versions on your computer before changing a working report.

Using Windows? Follow the separate Windows Excel and Snowflake private-key guide.

1. Confirm the Mac connection route

Check Excel → About Microsoft Excel and Apple menu → About This Mac. Record the Excel version, macOS version, and whether the machine uses Apple silicon or Intel. Ask your administrator to confirm the Snowflake login name, server hostname, warehouse, reporting role, database, and schema.

Microsoft documents Data → From Database (Microsoft Query) for connecting Excel for Mac to other databases through an installed ODBC driver. Menu wording can vary by Excel release. The SQL Server-specific import option is not a Snowflake connector. See Microsoft's Excel for Mac data-import instructions.

Start with a blank workbook. A Windows Power Query workbook is not proof that its connector and refresh behavior will work on a Mac. Keep a backup of any existing workbook and inspect how it connects before replacing its source.

2. Install compatible ODBC components

Follow Snowflake's macOS installation instructions for the driver version your administrator approves. Its Mac setup uses iODBC. Match the application, driver, and driver-manager architecture; a working command-line connection does not prove Excel can load the same components.

Check the installed driver before upgrading. Snowflake warns that installing ODBC 4.x replaces 3.x. Existing 3.x installations have separate instructions, and the 4.x migration guide explains the configuration changes. In particular, 3.x uses simba.snowflake.ini, while 4.x uses sf.odbc.ini for driver configuration. Those files are distinct from the DSN's odbc.ini.

Excel cannot always read the default driver location

Snowflake documents an Excel-specific ODBC 4.x issue: macOS app restrictions can prevent Excel from loading the driver or reading its configuration, even when an iODBC test works. Symptoms include a driver-load error, an empty alert, or repeated credential prompts.

Have IT follow the complete Snowflake Excel-for-Mac compatibility procedure. It covers an Excel-readable driver location, matching driver registration, and readable sf.odbc.ini configuration with DriverManagerEncoding=UTF-32 for iODBC. Recheck this configuration after driver upgrades.

The same guidance places key files inside Excel's application container. The next section uses that location. Do not disable macOS protections or repeatedly change Snowflake passwords to fix a driver-loading problem.

3. Create an encrypted key pair in Terminal

Open Applications → Utilities → Terminal. Check the installed encryption tool:

openssl version

If it is missing or your installation does not support the commands below, have IT provide an approved OpenSSL installation and use its executable path. Keep the same Terminal session open for the following commands.

Create a dedicated key directory inside Excel's container:

umask 077
excel_key_dir="$HOME/Library/Containers/com.microsoft.Excel/Data/.snowflake"
mkdir -p "$excel_key_dir"
chmod 700 "$excel_key_dir"
private_key="$excel_key_dir/excel_snowflake.p8"
public_key="$excel_key_dir/excel_snowflake.pub"

Check for existing files before generating anything:

if [ -e "$private_key" ] || [ -e "$public_key" ]; then
  printf '%s\n' 'STOP: key files already exist. Ask your administrator to review them.'
else
  printf '%s\n' 'No existing key files found. Continue with generation.'
fi

If the check says STOP, do not run the next command. A key may already support another connection.

Generate an encrypted RSA private key:

openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 \
  -aes-256-cbc -out "$private_key"

Choose a strong passphrase when prompted, confirm it, and save it in your password manager. Do not type the passphrase into the command itself. OpenSSL's genpkey reference documents these key-generation options.

Generate its matching public key:

openssl pkey -in "$private_key" -pubout -out "$public_key"
chmod 600 "$private_key" "$public_key"

Stop if either command fails. The .p8 file is the encrypted private key; it stays on this Mac. Send only the .pub file to your Snowflake administrator. The key passphrase is separate from your Snowflake login password.

4. Have the administrator register the public key

The administrator should inspect the exact Snowflake user first:

DESC USER EXAMPLE_USER;

Replace EXAMPLE_USER with the verified user identifier. Preserve quoting for case-sensitive identifiers. If the first public-key slot is unused:

ALTER USER EXAMPLE_USER
  SET RSA_PUBLIC_KEY = '<PUBLIC_KEY_BODY>';

Use the public key's base64 body without its BEGIN/END lines or line breaks. Preserve existing keys and follow the account's rotation process if a slot is occupied.

Compare RSA_PUBLIC_KEY_FP from DESC USER with this local fingerprint, after its SHA256: prefix:

openssl pkey -pubin -in "$public_key" -outform DER \
  | openssl dgst -sha256 -binary \
  | openssl enc -base64

Snowflake's key-pair authentication guide covers registration and rotation. The administrator must also grant the employee's reporting role access to the intended warehouse and data. Authentication does not grant table access.

5. Configure a User DSN

A DSN is the saved connection Excel selects by name. Snowflake documents these Mac locations:

Scope	Configuration file
Current Mac user	~/Library/ODBC/odbc.ini
System-wide	/Library/ODBC/odbc.ini

Use the existing file and preserve its other connections. Back it up before editing. An editor must save plain text, not rich text. Ask IT to confirm Excel sees the same DSN and driver registration you are editing.

Below is a template, not a command to paste into Terminal. Replace every angle-bracket placeholder before testing. Merge the data-source entry into an existing [ODBC Data Sources] section rather than duplicating that section.

[ODBC Data Sources]
SnowflakeExcel = Snowflake ODBC

[SnowflakeExcel]
Driver = <absolute-path-to-the-installed-Excel-accessible-driver-library>
server = <organization-account>.snowflakecomputing.com
uid = <YOUR_SNOWFLAKE_LOGIN_NAME>
warehouse = <REPORTING_WAREHOUSE>
role = <REPORTING_ROLE>
database = <DATABASE>
schema = <SCHEMA>
AUTHENTICATOR = SNOWFLAKE_JWT
PRIV_KEY_FILE = /Users/<mac-username>/Library/Containers/com.microsoft.Excel/Data/.snowflake/excel_snowflake.p8

Use your administrator's actual server hostname. Do not use a Snowsight browser URL. For PRIV_KEY_FILE, use the full path without surrounding quotes; do not put ~, $HOME, or $private_key into the DSN. To display the path from the Terminal session above:

printf '%s\n' "$private_key"

Supply the encrypted key's passphrase

The driver parameter is PRIV_KEY_FILE_PWD. Decide with IT how it will be supplied before testing. If your approved setup stores it in the User DSN, enter it locally in the same connection section. An INI file stores that value as readable text; it is not macOS Keychain. Restrict file access, exclude it from screenshots and shared folders, and do not put it into a workbook or shell command.

If that storage is not permitted, use an approved credential-supply mechanism or another supported authentication design. Do not remove key encryption to bypass the decision.

Snowflake's ODBC parameter reference lists the key settings and notes that externalbrowser authentication is unsupported with Excel on macOS. A successful browser sign-in from another application therefore does not establish Excel compatibility.

6. Test the driver and then Excel

First test the DSN with iODBC Administrator or the iodbctest utility installed with iODBC. Use the same connection name and approved key-passphrase setup. Record the exact driver error if it fails; do not publish logs containing credentials.

Then quit Excel completely with Command+Q and reopen it. Closing a workbook window alone can leave Excel running with earlier connection settings.

1. Open a blank workbook.
2. Use Data → From Database (Microsoft Query) and select the configured Snowflake DSN.
3. Use the driver-configured key-pair connection. Do not paste the private key or its passphrase into an ordinary database-password prompt. If the dialog insists on password authentication, stop and check the DSN and driver configuration.
4. Preview a small approved table or query and choose Return Data to load the result.

A small context query helps confirm the identity and role:

SELECT CURRENT_USER(), CURRENT_ROLE(), CURRENT_WAREHOUSE();

Next, query a small amount of the reporting data itself. The context query does not establish that the role can read a particular table.

Save the workbook, quit Excel, reopen it, and refresh again. Then test the real report's queries, formulas, and PivotTables. Treat this successful reopened refresh as the completion check.

Troubleshooting Excel for Mac and Snowflake

Symptom	Next check
DSN does not appear	Correct Mac user, User versus System DSN, and the connection file Excel actually reads
Driver cannot load, but iODBC works	Excel-readable driver/configuration locations and the official 4.x compatibility procedure
Empty alert or repeated credential prompt	Driver-manager encoding and readable configuration, before changing credentials
Required PRIV_KEY_FILE setting is missing	Exact parameter name and active DSN section; fully quit and reopen Excel
Key file cannot be opened	Absolute path, Excel container location, file permissions, and passphrase
JWT authentication fails	Exact account and login name, registered fingerprint, machine clock, and authentication policy
Login succeeds but reporting data is unavailable	Role, warehouse, database, schema, and object privileges
Windows workbook fails on Mac	Its actual connector, query structure, and Mac support rather than only the DSN name
Connection breaks after a driver upgrade	Driver registration, Excel-accessible copy, and version-specific configuration

Keep the error, driver version, and failing step together when asking for help. Avoid changing the driver, key pair, and workbook source at the same time; one change followed by one test makes the result easier to interpret.

For help with the account-side roles and permissions, see Snowflake initial setup. If the connection needs to support a wider reporting team, discuss your Snowflake reporting setup before distributing a workbook that depends on one person's local credentials.