Snowflake is read-only in Duvo. Agents can run
SELECT-style queries but cannot modify your data.Setup
Confirm prerequisites
A Snowflake account with key-pair authentication enabled for the connecting user.
An RSA key pair generated for the user, with the public key registered in Snowflake. You provide the private key to Duvo.
A compute warehouse available for the role you plan to use.
Grant the required permissions
The Snowflake role you specify must have:
USAGEon the target warehouse, database, and schemaSELECTon any tables or views your agents need to read
Add the connection in Duvo
On the Connections page, open Snowflake and fill in these fields:
The RSA private key for authentication, in PEM format. Include the full key with the
-----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY----- lines.Your Snowflake account identifier, either
orgname-accountname (e.g. myorg-myaccount) or the legacy locator (e.g. xy12345.us-east-1). Find it in your account URL or under Admin > Accounts.The Snowflake user configured with your public key.
The default database to connect to.
The default schema within the database.
The compute warehouse to use for queries.
The Snowflake role to assume for the session. This determines what data the agent can access.
Optional. The passphrase used to decrypt the private key, if the key is encrypted.
Third-party documentation
Third-party documentation
- Snowflake key-pair authentication — generating RSA keys and assigning the public key to a user.
- Snowflake account identifiers — how to find your account identifier.
- Snowflake access control — roles, privileges, and granting SELECT access.
Capabilities
- Run read-only SQL queries — execute SELECT, WITH (CTEs), SHOW, DESCRIBE, and EXPLAIN statements against your warehouse. Write operations are not permitted.
- Discover tables and schemas — list all tables in a given database and schema, including row counts and comments, so agents can understand the data landscape before querying.
- Verify connection details — check the active user, role, database, schema, and warehouse to confirm the session is configured correctly.
- Export large result sets — query results exceeding 5,000 rows are automatically exported as CSV files for downstream analysis rather than returned inline.
Key Benefits
- Live warehouse data — agents read directly from Snowflake instead of relying on stale exports or manual data pulls.
- Safe by design — only read-only operations are allowed, so your data cannot be modified through Duvo.
- Role-scoped access — the Snowflake role you specify controls exactly which databases, schemas, and tables the agent can reach.
- Large-scale results — automatic CSV export handles result sets of any size without truncation.
- Key-pair authentication — no passwords are stored; authentication uses RSA key pairs for stronger security.
Works Well With
Google Sheets
Query Snowflake and write the results into a spreadsheet for stakeholder review or recurring reports.
Gmail
Pull warehouse metrics and include them in automated email summaries or alerts.
Slack
Monitor key business thresholds and post a notification to a channel when values change.
Outcome Examples
Scheduled KPI report
Scheduled KPI report
Every Monday, a summary of last week’s revenue, order volume, and exception count is posted to your team’s Slack channel or emailed to stakeholders. The agent queries your warehouse, calculates week-over-week changes, and distributes the formatted result automatically. No one needs to open Snowflake or prepare a report manually.
Threshold alert
Threshold alert
An agent polls Snowflake every hour and fires a Slack notification when inventory drops below the reorder point, a fraud rate crosses a limit, or any other condition is met. It stays silent when everything is within bounds, so alerts stay signal, not noise.
On-demand data export to Google Sheets
On-demand data export to Google Sheets
A stakeholder needs a fresh customer list, transaction export, or regional breakdown. The agent runs the query and writes the results into a named Google Sheet, including a “last refreshed” timestamp. Run on demand or on a schedule.