Connecting a BI tool with a Snowflake service user

Last updated: November 11, 2026

Overview

A service user is a Snowflake user made for tools rather than people. BI tools such as Power BI and Tableau use it to connect to your gaiia Snowflake reader account and refresh your dashboards without relying on anyone's personal login.

Service users sign in with a private key instead of a password. Your dashboards keep working when a team member leaves or resets their password, and you can cut off one tool's access without affecting anyone else. A service user can't sign in to the Snowflake web interface: it exists only for tool connections.

In this article, we'll be covering how to create a service user, connect your BI tool, rotate its credentials and delete it.

Before you start

Creating a service user

Create one service user per tool, for example one for Power BI and one for Tableau. You can then rotate or remove access for one tool without affecting the others.

The private key is shown only once. Copy or download it before you close the dialog. If you lose it, rotate the service user's credentials to get a new one.

  1. Go to Admin > Snowflake.

  2. In the Service Users section, click New service user.

  3. Enter a Service name, for example power-bi.

    Letters, numbers, underscores and hyphens are allowed.

  4. Leave Grant admin role to service user unchecked.

    The admin role is for managing the reader account itself. Reading your gaiia data doesn't need it.

  5. Click Create.

  6. Click Download .pem file, or copy the private key.

  7. Click Close.

Store the private key in a password manager or secrets vault. Don't share it by email or chat.

The service user's Username appears in the dialog and in the Service Users table. It follows the pattern TENANT_<ACCOUNT>_<SERVICE NAME>_USER: a service named power-bi gets a username ending in _POWER_BI_USER.

Connecting your BI tool

Most BI tools ask for the same connection details. Use these values:

Field

Value

Server

The address shown in Reader Account URL in Admin > Snowflake, without https://

Username

The service user's Username

Authentication

Key pair, using the private key you saved

Role

The service user's Default role from the Service Users table: PUBLIC unless you granted the admin role

Warehouse

DEFAULT_WAREHOUSE

Database

SHARED_DATABASE

Schema

Leave blank to browse every schema, or pick one

The private key isn't protected by a passphrase. If your tool asks for one, leave it blank.

To learn what each schema, table and field contains, contact gaiia support to request access to the Snowflake data dictionary.

Power BI

Power BI Desktop and the Power BI service both support key pair authentication with the Snowflake connector.

  1. In Power BI Desktop, select Get data, then Snowflake.

  2. Enter the Server and Warehouse values from the table above.

  3. When asked for credentials, select KeyPair.

  4. Enter the service user's Username and paste the full private key, including its first and last lines.

  5. After you publish your report, enter the same credentials in the Power BI service. There, you upload the .pem file instead of pasting the key.

Key pair authentication isn't available in Power BI Dataflows Gen1 or Power Apps dataflows.

Tableau

Tableau Desktop and Tableau Cloud support key pair authentication with the Snowflake connector. Choose key pair sign-in, then enter the service user's Username and select the .pem file.

Other tools

Any tool that supports Snowflake key pair authentication can connect with a service user. Check your tool's Snowflake connector documentation for where to enter the private key.

Rotating a service user's credentials

Rotate a service user's credentials when someone with access to its key leaves your team, when you suspect the key was exposed, or on a regular schedule.

The current key stops working as soon as you confirm. Any tool using it fails to connect until you update it with the new key.

  1. Go to Admin > Snowflake.

  2. In the Service Users table, open the Ellipsis menu on the service user's row and click Rotate credentials.

  3. Click Rotate credentials to confirm.

  4. Click Download .pem file, or copy the new private key.

  5. Update the private key in your BI tool.

Deleting a service user

Deleting a service user can't be undone. Any tool using it stops connecting right away.

  1. Go to Admin > Snowflake.

  2. In the Service Users table, open the Ellipsis menu on the service user's row and click Delete.

  3. Confirm the deletion.

Restricting where connections come from

By default, a service user can connect from any IP address, as long as it has the private key. To allow connections only from your BI tool's addresses, a user with the admin role can create a network policy in your reader account. See Snowflake's network policies documentation.

Frequently asked questions

Why do I get "A service user with the same name already exists"?

Service names are converted to uppercase, and hyphens and periods become underscores, so power-bi and power_bi produce the same username. Pick a different service name, or delete the existing service user first.

Can a service user sign in to Snowflake in my browser?

No. Service users only connect through tools. To use the Snowflake web interface, add a user in the Users section of Admin > Snowflake.

Does my BI tool use Snowflake credits?

Yes. Queries run on DEFAULT_WAREHOUSE, which uses credits while it runs and pauses after one minute without activity. Scheduled dashboard refreshes count too. Your plan includes 50 credits, and usage beyond that is charged to your account. See About Snowflake.

Learn more