diff --git a/raster_loader/cli/snowflake.py b/raster_loader/cli/snowflake.py
index 37beeeb..9af3783 100644
--- a/raster_loader/cli/snowflake.py
+++ b/raster_loader/cli/snowflake.py
@@ -141,14 +141,24 @@ def upload(
         get_block_dims,
     )
 
-    if (
-        token is None
-        and (username is None or password is None)
-        and private_key_path is None
-    ) or all(v is not None for v in [token, username, password, private_key_path]):
+    if not (
+        (token is not None and username is None)
+        or (
+            token is None
+            and username is not None
+            and password is not None
+            and private_key_path is None
+        )
+        or (
+            token is None
+            and username is not None
+            and password is None
+            and private_key_path is not None
+        )
+    ):
         raise ValueError(
-            "Either --token or --private-key-path or --username and --password"
-            " must be provided."
+            "Either (--token) or (--username and --private-key-path) or"
+            " (--username and --password) must be provided."
         )
 
     if private_key_path is not None:
@@ -277,14 +287,24 @@ def describe(
     limit,
 ):
 
-    if (
-        token is None
-        and (username is None or password is None)
-        and private_key_path is None
-    ) or all(v is not None for v in [token, username, password, private_key_path]):
+    if not (
+        (token is not None and username is None)
+        or (
+            token is None
+            and username is not None
+            and password is not None
+            and private_key_path is None
+        )
+        or (
+            token is None
+            and username is not None
+            and password is None
+            and private_key_path is not None
+        )
+    ):
         raise ValueError(
-            "Either --token or --private-key-path or --username and --password"
-            " must be provided."
+            "Either (--token) or (--username and --private-key-path) or"
+            " (--username and --password) must be provided."
         )
 
     if private_key_path is not None:
diff --git a/raster_loader/tests/snowflake/test_cli.py b/raster_loader/tests/snowflake/test_cli.py
index a885231..fe4f7ab 100644
--- a/raster_loader/tests/snowflake/test_cli.py
+++ b/raster_loader/tests/snowflake/test_cli.py
@@ -181,7 +181,8 @@ def test_snowflake_credentials_validation(*args, **kwargs):
     )
     assert result.exit_code == 1
     assert (
-        "Either --token or --username and --password must be provided." in result.output
+        "Either (--token) or (--username and --private-key-path) or"
+        " (--username and --password) must be provided." in result.output
     )
 
     result = runner.invoke(
@@ -213,7 +214,8 @@ def test_snowflake_credentials_validation(*args, **kwargs):
     )
     assert result.exit_code == 1
     assert (
-        "Either --token or --username and --password must be provided." in result.output
+        "Either (--token) or (--username and --private-key-path) or"
+        " (--username and --password) must be provided." in result.output
     )