Skip to main content

Configure BYOK for dbt Wizard Beta

You can use the dbt Wizard CLI with bring-your-own-key (BYOK), which means you supply your own credentials from a supported AI provider instead of using dbt Labs' infrastructure.

Share your feedback!

We'd love to hear how dbt Wizard is working for you. Share your feedback by either running the /feedback slash command in your interactive terminal session or by going to the #dbt-wizard channel in the dbt Community Slack.

Thanks so much for your help in improving dbt Wizard and dbt data development!

The following BYOK instructions on this page apply to the CLI only. dbt platform uses a separate account-level integration.

The "key" in BYOK is whatever credential your chosen provider uses to authenticate API requests — an API key for OpenAI or Anthropic, a bearer token for AWS Bedrock, or a token/PAT for Snowflake Cortex. When you configure a provider with that credential, dbt Wizard calls the provider's API directly using it, so:

  • Usage costs appear on your provider account, not your dbt Labs account.
  • Token costs are billed by whichever provider you choose.

Supported AI providers​

dbt Wizard​

dbt Wizard supports different AI providers depending on where you use it.

Providerdbt Wizard in dbt platformdbt Wizard CLI
OpenAI✓ (managed or BYOK)✓ (OpenAI subscription or BYOK)
Anthropic†✓ (BYOK)✓ (BYOK)
Azure AI Foundry / Azure OpenAI✓ (BYOK)✓ (BYOK)
AWS Bedrock-✓ (BYOK)
Google Gemini-✓ (BYOK)
Snowflake Cortex-✓ (BYOK)

† Anthropic enterprise and subscription licenses (such as Claude Enterprise) aren't supported per Anthropic's terms of service. BYOK requires an Anthropic API key.

Configure a provider​

You can configure a provider in one of the following ways:

  • Terminal commands: Best for users who want to configure providers from the shell.
  • Interactive session: Best for most users working in the dbt Wizard text based user interface (TUI). Use the /providers slash command.
  • Environment variables: Best for headless runs, such as wizard exec, automation, or temporary local sessions.

Configure in the terminal​

In the terminal, use the providers subcommand to list, configure, and enable providers:

wizard providers list
wizard providers configure PROVIDER_NAME
wizard providers enable PROVIDER_NAME

Replace PROVIDER_NAME with the name of a supported provider, such as openai, anthropic, bedrock, azure, gemini, or snowflake. Then, follow the prompts to enter your credentials.

The wizard providers list command shows you the currently configured providers and their status:

➜  jaffle-shop git:(mwong-fusion) wizard providers list
provider              enabled  route      auth         models
dbt                   true     remote     dbt          3
openai                false    local      missing      3
openai_subscription   false    local      missing      1
anthropic             false    local      missing      3
bedrock               true     local      configured   15
azure                 false    local      missing      3
snowflake             false    local      missing      3
gemini                false    local      missing      3

The configure command prompts you to enter credentials for the selected provider. To use environment variables or set a key without echoing it in your shell history, refer to Set your API key.

So for example, if you're using OpenAI, you would run and follow the prompts to configure it:

wizard providers configure openai
wizard providers enable openai

To store an API key without echoing it in your shell history:

printf '%s' 'sk-...' | wizard providers set-key PROVIDER_NAME

Credentials are stored in ~/.dbt/wizard/provider-auth.json. Provider settings are stored in ~/.dbt/wizard/providers.json.

Configure in the TUI​

You can configure providers from an active CLI TUI session with the /providers slash command:

/providers

From the provider menu, you can:

  • Enable or disable a provider.
  • Add or update credentials.
  • Select available models.
  • Check whether a provider is authenticated and active.

Example provider menu:

/providers

  Model Providers
  Select a provider to inspect or update it.
 
› 1. dbt                  enabled; 3/3 models selected; uses dbt login; active
  2. openai               disabled; 3/3 models selected; missing credentials; needs setup
  3. openai_subscription  disabled; 1/1 models selected; not connected; needs setup
  4. anthropic            disabled; 3/3 models selected; authenticated; needs setup
  5. bedrock              enabled; 15/15 models selected; authenticated; active
  6. azure                disabled; 3/3 models selected; missing credentials; needs setup
  7. snowflake            disabled; 3/3 models selected; missing credentials; needs setup
  8. gemini               disabled; 3/3 models selected; missing credentials; needs setup

Set your API key​

The first time you start dbt Wizard in a project, onboarding prompts you to choose a provider.

  1. At the Configure a Provider prompt, select your provider.
  2. Paste your API key or provider credentials when prompted.
  3. Choose an AI model to finish setup.

To add or switch providers later from an active session, type /providers in the TUI.

When you configure a provider through dbt Wizard, credentials are stored in ~/.dbt/wizard/provider-auth.json.

To persist provider credentials, use one of the following options:

  • wizard providers configure PROVIDER_NAME
  • wizard providers set-key PROVIDER_NAME
  • The provider's environment variable

Choose an AI model​

You can change the AI model in the following ways:

MethodDescriptionExample
Interactive sessionChange the AI model interactively in the TUI./model
Invocation flagChange the AI model at invocation with the -m flag.wizard -m gpt-4o "refactor stg_orders to use incremental materialization"
Config fileSet a default AI model in the config file (~/.dbt/wizard/config.toml); applies to all future sessions. Run wizard debug models to list available model IDs.model = "gpt-4o"

Restart the dbt Wizard CLI after changing the model.

Examples​

The following examples use the same provider configuration flow described earlier, with provider-specific credential requirements.

AWS Bedrock​

AWS Bedrock is supported in the CLI only. dbt Wizard currently supports Bedrock through an Amazon Bedrock API key, not the full AWS credential chain. Ensure your AWS account has access to the Bedrock models you plan to use and that your Bedrock API key has permission to invoke them.

export AWS_BEARER_TOKEN_BEDROCK="ABSK..."
wizard providers enable bedrock
wizard providers bedrock set-region us-east-1
wizard providers list
wizard debug models

To set a default Bedrock model, add the model ID to ~/.dbt/wizard/config.toml:

model = "BEDROCK_MODEL_ID"

Snowflake Cortex Preview​

Snowflake Cortex BYOK support in the CLI is in preview. Availability and setup steps may change. Ensure your Snowflake account has the privileges required for Cortex large language model (LLM) functions. Refer to the Snowflake Cortex documentation.

You can authenticate with Snowflake Cortex using an API token or a Programmatic Access Token (PAT) (for SSO and Okta users).

wizard providers list
wizard providers enable snowflake
wizard providers configure snowflake
wizard providers list
wizard debug models

The wizard providers configure snowflake command walks you through the following prompts:

Enable this provider? [Y/n]:
Models to enable [1]:
Snowflake account ID:
Snowflake API base override (optional):
Paste API key/token, or press enter to configure it later:
PromptWhat to enter
Snowflake account IDYour Snowflake account identifier (for example, myorg-myaccount)
Snowflake API base override (optional)Leave blank — this is only needed for custom or private Snowflake endpoints
Paste API key/tokenYour authentication token — refer to Authentication options in the next section

Authentication options​

The key/token field accepts a regular API token or a Programmatic Access Token (PAT), depending on how your Snowflake account is configured. Both are entered in the same place — the Paste API key/token prompt in the terminal, or Set key/token (option 3) in the TUI.

  1. In your Snowflake account, generate your API or PAT token.
  2. Select Generate token and copy the token value.
  3. Go back to dbt Wizard and paste the PAT at the key/token prompt.

To set a default Snowflake Cortex model, add the model ID to ~/.dbt/wizard/config.toml:

model = "SNOWFLAKE_CORTEX_MODEL_ID"

Was this page helpful?

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

0
Loading