risingwavelabs/risingwave · error · SinkError::Config

auth.method=key_pair_object must not set `password`

Error message

auth.method=key_pair_object must not set `password`

What it means

The Snowflake sink connector validates the auth configuration parsed from the user's WITH options map. When `auth.method` is explicitly set to `key_pair_object`, the key-pair authentication path is used, which authenticates with a private key (supplied inline as `private_key_pem`); a `password` would conflict with that mechanism, so the connector refuses the combination at sink creation time.

Source

Thrown at src/connector/src/sink/snowflake_redshift/snowflake.rs:319

                    return Err(SinkError::Config(anyhow!(
                        "auth.method=key_pair_file must not set `password`"
                    )));
                }
                if has_pem {
                    return Err(SinkError::Config(anyhow!(
                        "auth.method=key_pair_file must not set `private_key_pem`"
                    )));
                }
                AUTH_METHOD_KEY_PAIR_FILE.to_owned()
            }
            Some(method) if method == AUTH_METHOD_KEY_PAIR_OBJECT => {
                if !has_pem {
                    return Err(SinkError::Config(anyhow!(
                        "auth.method=key_pair_object requires `private_key_pem`"
                    )));
                }
                if has_password {
                    return Err(SinkError::Config(anyhow!(
                        "auth.method=key_pair_object must not set `password`"
                    )));
                }
                AUTH_METHOD_KEY_PAIR_OBJECT.to_owned()
            }
            Some(other) => {
                return Err(SinkError::Config(anyhow!(
                    "invalid auth.method: {} (allowed: password | key_pair_file | key_pair_object)",
                    other
                )));
            }
            None => {
                // Infer auth method from supplied fields
                match (has_password, has_file, has_pem) {
                    (true, false, false) => AUTH_METHOD_PASSWORD.to_owned(),
                    (false, true, false) => AUTH_METHOD_KEY_PAIR_FILE.to_owned(),
                    (false, false, true) => AUTH_METHOD_KEY_PAIR_OBJECT.to_owned(),
                    (true, true, _) | (true, _, true) | (false, true, true) => {

View on GitHub (pinned to 6469eb736d)

Solutions

1. Remove the `password` option from the sink's WITH clause.
2. Keep `auth.method='key_pair_object'` and supply `private_key_pem` (and `private_key_passphrase` if the key is encrypted).
3. If password auth is actually intended, set `auth.method='password'` instead and keep the password.

Example fix

// before
WITH (
  connector = 'snowflake',
  auth.method = 'key_pair_object',
  password = 'mypassword',
  private_key_pem = '...'
)
// after
WITH (
  connector = 'snowflake',
  auth.method = 'key_pair_object',
  private_key_pem = '...'
)

const opts = { 'auth.method': 'key_pair_object', password: 'x' };
if (opts['auth.method'] === 'key_pair_object' && opts.password) {
  throw new Error('Remove `password` when auth.method=key_pair_object');
}

When it happens

Trigger: Calling the sink `from_btreemap` constructor (via CREATE SINK) with options containing `auth.method = 'key_pair_object'` AND a `password` entry at the same time.

Common situations: Copy-pasting an old password-based sink definition and only adding `auth.method='key_pair_object'` (or switching auth methods during a security migration) without removing the leftover `password` option.

Understand the failure class

Background: Conflicting config options: "cannot be used together" — configuration validation errors across open-source libraries — this error's family across 162 libraries.

Related errors

• ambiguous auth: multiple auth options provided; remove one o
• intermediate.table.name is required for non-append-only sink
• invalid auth.method: {} (allowed: password | key_pair_file |
• no authentication configured: set either `password`, or `pri
• table.name is required

AI-assisted analysis of risingwavelabs/risingwave@6469eb736d (2026-09-11). Data as JSON: /api/errors/01b00fefcac1a9f7. Report an issue: GitHub.