The issue you're experiencing is due to the use of the

externalbrowser

authentication method with the Elementary CLI. When using OSS Elementary (the CLI) with Snowflake and MFA enabled (which typically requires `externalbrowser`/SSO), the CLI cannot handle interactive browser authentication in a non-interactive environment (like a terminal or CI/CD pipeline). This results in repeated login prompts or failures, as the CLI cannot complete the authentication flow. This is a known limitation. The Elementary CLI requires a non-interactive authentication method, such as user/password or key pair authentication, because it needs to authenticate silently. The

externalbrowser

method is designed for interactive use and is not supported for CLI-based workflows. This has been confirmed in several support threads: - "The 'externalbrowser' authentication is not supported, as this is a CLI and this method requires a manual interference. Could you use user/password or key pair authentication?" - "Browser authentication requires interactive authentication which is not supported at the moment but we are researching a solution for it. In the meantime if you can use another authentication method that would be great" - "It tries to open a browser and authenticate with OKTA and fails to find the browser." [Source 1](https://slack.com/archives/C02CTC89LAX/p1660217198018729) [Source 2](https://slack.com/archives/C02CTC89LAX/p1660757938346229) [Source 3](https://slack.com/archives/C02CTC89LAX/p1680277191269769) What you can do: - If possible, request a service account or user/password credentials for use with the CLI. - Alternatively, use key pair authentication, which is supported and works well in automated environments. If your organization only allows SSO/MFA via

externalbrowser

, you will not be able to use the OSS Elementary CLI until support for non-interactive SSO authentication is available. If you need further help, you can reach out to the Elementary team on their [Slack community](https://elementary-data.com/community). Let me know if you need guidance on setting up user/password or key pair authentication!

To connect to Snowflake using key pair authentication with OSS Elementary, you need to configure your

profiles.yml

file to use the

private_key_path

and (optionally)

private_key_passphrase

fields. Here’s how you can do it: 1. Generate a private key for your Snowflake user, following [Snowflake’s documentation](https://docs.snowflake.com/en/user-guide/key-pair-auth#configuring-key-pair-authentication). 2. Store the private key securely on the machine where you will run Elementary. 3. Configure your

profiles.yml

for the

elementary

profile as follows:

yaml elementary:   outputs:     default:       type: snowflake       account: <your_account>       user: <your_user>       private_key_path: /path/to/your/private_key       private_key_passphrase: <your_passphrase>  # Optional, if your key is encrypted       role: <your_role>       warehouse: <your_warehouse>       database: <your_database>       schema: <your_schema>_elementary       threads: 4

- Replace the placeholders with your actual values. - Make sure the

private_key_path

points to the correct location of your private key file. 4. Run Elementary CLI commands as usual. The CLI will use the key pair for authentication. This approach is supported and has been confirmed to work in both local and CI/CD environments, such as GitHub Actions. If you are using GitHub Actions, you can upload your private key as a secret, write it to a file in the workflow, and reference that file in your

profiles.yml

as shown above. For more details, see the relevant [Slack discussion](https://slack.com/archives/C02CTC89LAX/p1680277191269769) and [another example](https://slack.com/archives/C02CTC89LAX/p1680536448292429). If you need more detailed step-by-step instructions for your specific environment, let me know!