{"record":{"id":"130d82b578a8156e","repo":"crewAIInc/crewAI","slug":"either-password-or-private-key-path-must-be-provid","errorCode":null,"errorMessage":"Either password or private_key_path must be provided","messagePattern":"Either password or private_key_path must be provided","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"lib/crewai-tools/src/crewai_tools/tools/snowflake_search_tool/snowflake_search_tool.py","lineNumber":63,"sourceCode":"    )\n    user: str = Field(..., description=\"Snowflake username\")\n    password: SecretStr | None = Field(None, description=\"Snowflake password\")\n    private_key_path: str | None = Field(None, description=\"Path to private key file\")\n    warehouse: str | None = Field(None, description=\"Snowflake warehouse\")\n    database: str | None = Field(None, description=\"Default database\")\n    snowflake_schema: str | None = Field(None, description=\"Default schema\")\n    role: str | None = Field(None, description=\"Snowflake role\")\n    session_parameters: dict[str, Any] | None = Field(\n        default_factory=dict, description=\"Session parameters\"\n    )\n\n    @property\n    def has_auth(self) -> bool:\n        return bool(self.password or self.private_key_path)\n\n    def model_post_init(self, *args: Any, **kwargs: Any) -> None:\n        if not self.has_auth:\n            raise ValueError(\"Either password or private_key_path must be provided\")\n\n\nclass SnowflakeSearchToolInput(BaseModel):\n    \"\"\"Input schema for SnowflakeSearchTool.\"\"\"\n\n    model_config = ConfigDict(protected_namespaces=())\n\n    query: str = Field(..., description=\"SQL query or semantic search query to execute\")\n    database: str | None = Field(None, description=\"Override default database\")\n    snowflake_schema: str | None = Field(None, description=\"Override default schema\")\n    timeout: int | None = Field(300, description=\"Query timeout in seconds\")\n\n\nclass SnowflakeSearchTool(BaseTool):\n    \"\"\"Tool for executing queries and semantic search on Snowflake.\"\"\"\n\n    name: str = \"Snowflake Database Search\"\n    description: str = (","sourceCodeStart":45,"sourceCodeEnd":81,"githubUrl":"https://github.com/crewAIInc/crewAI/blob/754d7323beb2fd042e33444a115ea2d5a47193f0/lib/crewai-tools/src/crewai_tools/tools/snowflake_search_tool/snowflake_search_tool.py#L45-L81","documentation":"SnowflakeSearchTool's config model (SnowflakeConfig) enforces in model_post_init that at least one authentication method is present: password or private_key_path. If both are unset, ValueError is raised immediately at configuration time, before any connection attempt. This is a fail-fast guard against ambiguous/absent credentials.","triggerScenarios":"Building SnowflakeConfig/SnowflakeSearchTool with only account and user but neither password nor private_key_path; intending key-pair auth but misspelling private_key_path (e.g. private_key_file); relying on an env var the config does not read.","commonSituations":"Users assuming SSO/browser auth works because the snowflake connector supports it; typos in the field name for the key path; secrets loaded asynchronously (e.g. from a vault) so the config is constructed before credentials arrive.","solutions":["Pass password=\"...\" for password auth, or private_key_path=\"/path/to/rsa_key.p8\" for key-pair auth — exactly one is sufficient.","Check for typos: the field is private_key_path, not private_key_file or key_path.","If credentials come from a vault/secret manager, fetch them before constructing the config object."],"exampleFix":"# before\nconfig = SnowflakeConfig(account=\"xy123\", user=\"ME\")\n\n# after\nconfig = SnowflakeConfig(account=\"xy123\", user=\"ME\", password=os.environ[\"SNOWFLAKE_PASSWORD\"])","handlingStrategy":"validation","validationCode":"if not (password or private_key_path):\n    raise ValueError(\"Provide SNOWFLAKE_PASSWORD or SNOWFLAKE_PRIVATE_KEY_PATH\")\nconfig = SnowflakeConfig(\n    account=account, user=user,\n    password=password, private_key_path=private_key_path,\n)","typeGuard":null,"tryCatchPattern":"try:\n    config = SnowflakeConfig(account=a, user=u, password=p, private_key_path=k)\nexcept ValueError as e:\n    if \"password or private_key_path\" in str(e):\n        # fetch credentials from vault, then retry construction\n        raise","preventionTips":["Assert at startup that exactly one of SNOWFLAKE_PASSWORD / SNOWFLAKE_PRIVATE_KEY_PATH is set.","Resolve secrets from your vault before constructing the config, not after."],"tags":["snowflake","authentication","configuration","credentials"],"backgroundTag":null,"analyzedSha":"754d7323beb2fd042e33444a115ea2d5a47193f0","analyzedAt":"2026-08-15T04:06:56.746Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}