Snowflake to Excel

Excel can refresh Snowflake data through the Snowflake ODBC driver. The private key stays on the computer, Snowflake holds the public key, and a reporting role decides what the workbook can read.

Book a Call

The short answer

A key-pair connection needs three things: an encrypted private key on the computer, its public key registered on the Snowflake user, and an ODBC data source that points to the key. What usually breaks is driver architecture, private-key settings the Windows dialog does not show, Mac Excel being unable to read the driver, and a connection that only works during the setup session.

What Excel reads from Snowflake

Approved tables and views
Loaded through Navigator on Windows or Microsoft Query on Mac, using a read-only reporting role.
Custom SQL queries
A small SQL query under Advanced options in From ODBC, or a query in Microsoft Query, with no credentials in the query text.
Session context
CURRENT_USER, CURRENT_ROLE and CURRENT_WAREHOUSE confirm which identity and role Excel is using. They do not prove the role can read a table.
Workbooks that refresh
Queries feeding formulas, PivotTables and charts, refreshed with the same approved connection after the workbook is reopened.

How we set it up

  1. 1

    Record the existing connection

    We back up the workbook and record the login name, server hostname, warehouse, role, database, schema, DSN, Excel architecture and driver version before changing anything.

  2. 2

    Generate and register the key pair

    The encrypted private key stays in a local folder. An administrator registers the public key without replacing a key in use, and we compare fingerprints.

  3. 3

    Configure the ODBC data source

    We set AUTHENTICATOR to SNOWFLAKE_JWT and PRIV_KEY_FILE to the full key path, and agree with IT how the key passphrase is supplied.

  4. 4

    Test, reopen and refresh

    We test a blank workbook, then the real report. The connection is done when the workbook refreshes after saving, closing Excel completely and reopening.

What breaks, and how we handle it

Windows dialog without private-key fields
The ODBC dialog can show a password box but no key fields. We add PRIV_KEY_FILE as a string value on the User DSN in the registry, then reopen the dialog and recheck the authenticator.
32-bit or 64-bit Excel
A 64-bit Windows install does not mean Excel is 64-bit. We match the ODBC driver and ODBC Data Source Administrator to Excel.
Native connector versus ODBC
A query using Snowflake.Databases uses the native connector, so changing the DSN will not change it. We validate an ODBC source before swapping the source step.
Mac Excel cannot load the driver
macOS app restrictions can stop Excel loading the ODBC 4.x driver even when an iODBC test works. IT follows Snowflake’s compatibility procedure, and the key goes inside Excel’s container.
Passphrase stored as readable text
A DSN, registry entry or odbc.ini file is not a password vault. If storing the passphrase is not permitted, IT supplies it another approved way. We never remove the key encryption.

What we build on top of the Snowflake data

  • Read-only reporting role with warehouse, database and object grants
  • Approved reporting tables and views for workbook queries
  • Per-person connection setup so a shared workbook never carries a private key
  • Handover record of key owner, rotation process and connection settings

Common questions

Can Excel connect to Snowflake with a private key?

Yes, through the Snowflake ODBC driver. Set AUTHENTICATOR to SNOWFLAKE_JWT, point PRIV_KEY_FILE at the encrypted key and supply PRIV_KEY_FILE_PWD in an approved way. On Windows this uses Power Query From ODBC, and on Mac Microsoft Query.

What does “Required setting PRIV_KEY_FILE is not present” mean?

The driver did not receive the key file path. It does not yet mean a bad passphrase or mismatched key. Check the exact value name, the DSN and Windows account, then close and reopen ODBC Data Sources before testing again.

Does registering the public key give access to my tables?

No. Key registration handles authentication only. The role still needs grants on the warehouse, database, schema and objects. Use a read-only reporting role, not an administrative one.

Can I share a Snowflake-connected workbook with a colleague?

The recipient needs their own authorized identity, driver, DSN and credential setup. Sending the workbook should not send your private key, and check whether it holds cached data that should not be shared.

Can I use browser sign-in from Excel on a Mac?

Snowflake’s ODBC parameter reference notes that externalbrowser authentication is unsupported with Excel on macOS. A browser sign-in from another application does not prove Excel will work.

Want Snowflake data you can trust?

Bring the Snowflake reports that don't match. We'll trace them to the source and show you where to start.

Book a Call