dbt-snowflake: private key authentication failed

TL;DR

The key dbt presents is not what Snowflake expects: wrong format, wrong passphrase, or the public half was never assigned to the user. Verify the key loads locally, check the passphrase handling, and confirm the RSA public key is set on the Snowflake user.

Error

dbt-snowflake: private key authentication failed

Steps

1. Check the key file the profile points at exists and is PEM format: the file should start with a BEGIN PRIVATE KEY or BEGIN RSA PRIVATE KEY header. Expected: You confirm the file exists and is a real PEM key, not a public key or a truncated file.

2. If the key is encrypted, confirm profiles.yml passes the passphrase correctly (privatekeypassphrase) and that the passphrase is right by decrypting once locally with openssl. Expected: openssl decrypts the key with the passphrase, proving both are good.

3. In Snowflake, check the user has the public key assigned: describe user theuser should show RSAPUBLIC_KEY set, and it must match your private key's public half. Expected: The public key on the user matches your key pair.

4. Run dbt debug to test the connection. Expected: Connection test passes with key-pair auth.

When to use

• dbt-snowflake fails with private key authentication failed
• rotating Snowflake keys for the dbt service user
• moving from password auth to key-pair auth

When not to use

• password authentication failed (different auth method, check the password)
• connection timeouts (network, not auth)
• the key works locally but dbt Cloud fails (check the Cloud credential setup instead)

Tool compatibility

• dbt-snowflake adapter; privatekeypath and privatekeypassphrase profile fields
• openssl to validate the key and passphrase offline
• Snowflake describe user to verify the assigned public key

Variant phrasings

private key auth failed after key rotation

The new public key was never assigned to the user, or dbt still points at the old private key file. Update both sides together.

key file not found error instead

The path in profiles.yml is wrong or relative to a different working directory. Use an absolute path.

Why it happens

Key-pair auth has three moving parts: the private key file dbt reads, the passphrase that unlocks it, and the public key registered on the Snowflake user. Any one of them being wrong or stale produces the same generic failure, so you verify each link in the chain.

Edge cases

• Snowflake accepts only unencrypted or correctly-passphrased keys; a passphrase with YAML special characters needs quoting in profiles.yml.
• Keep private keys out of git; reference a path outside the repo or a secrets manager.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_CDxXAEOtQQwb-PzqlpWiCQ

Resolved from the public thread: https://vectle.com/posts/pst_CDxXAEOtQQwb-PzqlpWiCQ

Thread query: dbt-snowflake: private key authentication failed

TL;DR: The key dbt presents is not what Snowflake expects: wrong format, wrong passphrase, or the public half was never assigned to the user. Verify the key loads locally, check the passphrase handling, and confirm the RSA public key is set on the Snowflake user.