risingwavelabs/risingwave · error · SinkError::Config

invalid auth.method: {} (allowed: password | key_pair_file |

Error message

invalid auth.method: {} (allowed: password | key_pair_file | key_pair_object)

What it means

The Snowflake sink's `auth.method` option only accepts three values: `password`, `key_pair_file`, or `key_pair_object`. Any other string reaches the fall-through arm of the match in `from_btreemap` and is rejected, with the offending value and the allowed set included in the message.

Source

Thrown at src/connector/src/sink/snowflake_redshift/snowflake.rs:326

                    )));
                }
                AUTH_METHOD_KEY_PAIR_FILE.to_owned()
            }
            Some(method) if method == AUTH_METHOD_KEY_PAIR_OBJECT => {
                if !has_pem {
                    return Err(SinkError::Config(anyhow!(
                        "auth.method=key_pair_object requires `private_key_pem`"
                    )));
                }
                if has_password {
                    return Err(SinkError::Config(anyhow!(
                        "auth.method=key_pair_object must not set `password`"
                    )));
                }
                AUTH_METHOD_KEY_PAIR_OBJECT.to_owned()
            }
            Some(other) => {
                return Err(SinkError::Config(anyhow!(
                    "invalid auth.method: {} (allowed: password | key_pair_file | key_pair_object)",
                    other
                )));
            }
            None => {
                // Infer auth method from supplied fields
                match (has_password, has_file, has_pem) {
                    (true, false, false) => AUTH_METHOD_PASSWORD.to_owned(),
                    (false, true, false) => AUTH_METHOD_KEY_PAIR_FILE.to_owned(),
                    (false, false, true) => AUTH_METHOD_KEY_PAIR_OBJECT.to_owned(),
                    (true, true, _) | (true, _, true) | (false, true, true) => {
                        return Err(SinkError::Config(anyhow!(
                            "ambiguous auth: multiple auth options provided; remove one or set `auth.method`"
                        )));
                    }
                    _ => {
                        return Err(SinkError::Config(anyhow!(
                            "no authentication configured: set either `password`, or `private_key_file`, or `private_key_pem` (or provide `auth.method`)"

View on GitHub (pinned to 6469eb736d)

Solutions

1. Use exactly one of: `password`, `key_pair_file`, or `key_pair_object` for `auth.method`.
2. Fix the spelling/case to match the allowed values shown in the error message.
3. If unsure, omit `auth.method` entirely and let the connector infer the method from the supplied credentials.

Example fix

// before
WITH (
  connector = 'snowflake',
  auth.method = 'keypair_file',
  private_key_file = '/path/key.p8'
)
// after
WITH (
  connector = 'snowflake',
  auth.method = 'key_pair_file',
  private_key_file = '/path/key.p8'
)

const ALLOWED = ['password', 'key_pair_file', 'key_pair_object'];
if (opts['auth.method'] && !ALLOWED.includes(opts['auth.method'])) {
  throw new Error(`auth.method must be one of ${ALLOWED.join('|')}`);
}

const isAuthMethod = (v) => ['password','key_pair_file','key_pair_object'].includes(v);

When it happens

Trigger: Setting `auth.method` to a misspelled or unsupported value such as `keypair`, `key_pair`, `oauth`, or `Key_Pair_File` when creating a Snowflake sink.

Common situations: Typos in DDL, using names remembered from other tools' connectors, or following outdated documentation that used a different method name.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• auth.method=key_pair_object must not set `password`
• ambiguous auth: multiple auth options provided; remove one o
• no authentication configured: set either `password`, or `pri
• sink format unsupported: {}
• sink encode unsupported: {}

AI-assisted analysis of risingwavelabs/risingwave@6469eb736d (2026-09-11). Data as JSON: /api/errors/e9c77a486c0e1625. Report an issue: GitHub.