Snowtype failing to authenticate

The keys used to authenticate Snowtype are added to headers during token exchange. A VPN configuration might sometimes enforce a proxy that removes the headers.

There are two options to resolve this. Either check with the relevant team in your organisation if there is a way to bypass that with a configuration change in the VPN settings or use another system that you trust that it's not behind a VPN. For example, you can have the configuration for Snowtype in your project and generate the code using GitHub Actions.
 

Another reason why Snowtype can fail authentication is Node rejecting untrusted certificates.

Example error message: Error: Authentication failed. Check if your API key and organization ID are correct.
 

To confirm this is the cause, run:

NODE_TLS_REJECT_UNAUTHORIZED=0 npx snowtype init

If it now succeeds, confirms root cause is certificate trust.

Resolution options:

• Trust the OS store (only supported in some Node versions)
• Add the proxy's root Certificate Authority(CA) certificate -- e.g. the Zscaler root -- to Node's trusted CAs by pointing NODE_EXTRA_CA_CERTS at a PEM file containing it (from your security team or the OS keychain).
• Ask your network team to allowlist console.snowplowanalytics.com from TLS inspection
• Run Snowtype from a separate environment outside the proxy network: commit the Snowtype and generate via GitHub Actions

Verify: re-run npx snowtype init without the =0 flag.