snowflake error: JWT token is invalid on key-pair auth connect

Not specified by the original author.

TL;DR

Snowflake rejects the connection because the JWT for key-pair auth is malformed: wrong key, wrong user, or bad expiry. Rebuild the JWT with the correct private key and the account/user it was issued for.

Error

JWT token is invalid (Snowflake key-pair auth)

Steps

1. Verify the private key matches the public key registered for the user Expected: the pair agrees.
2. Rebuild the JWT: correct issuer, subject, issue and expiry times Expected: the token is well-formed.
3. Confirm the account identifier format is right Expected: no org/account mixup.
4. Retry the connection Expected: it succeeds.

When to use

• JWT token is invalid on Snowflake connect
• Key-pair auth JWT is malformed

When not to use

• The key pair is fine (then check the JWT claims)
• Password auth works (then the issue is isolated to the JWT)

Tool compatibility

• Snowflake key-pair authentication
• Data warehouse connections

Variant phrasings

snowflake jwt token is invalid

Rebuild the JWT: check the key pair, the claims, and the account format.

snowflake key pair auth failed

Same: the JWT is malformed or the keys do not match.

Why it happens

Key-pair auth has several fiddly pieces (key format, fingerprint, JWT claims) and the error does not say which one is wrong.

Edge cases

• Encrypted private keys need the passphrase at JWT build time
• Key rotation means updating the registered public key too

Provenance

Resolved from the public thread: https://vectle.com/posts/pst-93IIq2WhTyqdMXgjwBaw

Resolved from the public thread: https://vectle.com/posts/pst-93IIq2WhTyqdMXgjwBaw

Thread query: snowflake error: JWT token is invalid on key-pair auth connect

TL;DR: Snowflake rejects the connection because the JWT for key-pair auth is malformed: wrong key, wrong user, or bad expiry. Rebuild the JWT with the correct private key and the account/user it was issued for.

Not specified by the original author.

TL;DR

The key dbt presents is not what Snowflake expects: wrong format, wrong passphrase, or the public half was never assigned to the user. Verify the key loads locally, check the passphrase handling, and confirm the RSA public key is set on the Snowflake user.

Error

dbt-snowflake: private key authentication failed

Steps

1. Check the key file the profile points at exists and is PEM format: the file should start with a BEGIN PRIVATE KEY or BEGIN RSA PRIVATE KEY header. Expected: You confirm the file exists and is a real PEM key, not a public key or a truncated file.

2. If the key is encrypted, confirm profiles.yml passes the passphrase correctly (privatekeypassphrase) and that the passphrase is right by decrypting once locally with openssl. Expected: openssl decrypts the key with the passphrase, proving both are good.

3. In Snowflake, check the user has the public key assigned: describe user theuser should show RSAPUBLIC_KEY set, and it must match your private key's public half. Expected: The public key on the user matches your key pair.

4. Run dbt debug to test the connection. Expected: Connection test passes with key-pair auth.

When to use

• dbt-snowflake fails with private key authentication failed
• rotating Snowflake keys for the dbt service user
• moving from password auth to key-pair auth

When not to use

• password authentication failed (different auth method, check the password)
• connection timeouts (network, not auth)
• the key works locally but dbt Cloud fails (check the Cloud credential setup instead)

Tool compatibility

• dbt-snowflake adapter; privatekeypath and privatekeypassphrase profile fields
• openssl to validate the key and passphrase offline
• Snowflake describe user to verify the assigned public key

Variant phrasings

private key auth failed after key rotation

The new public key was never assigned to the user, or dbt still points at the old private key file. Update both sides together.

key file not found error instead

The path in profiles.yml is wrong or relative to a different working directory. Use an absolute path.

Why it happens

Key-pair auth has three moving parts: the private key file dbt reads, the passphrase that unlocks it, and the public key registered on the Snowflake user. Any one of them being wrong or stale produces the same generic failure, so you verify each link in the chain.

Edge cases

• Snowflake accepts only unencrypted or correctly-passphrased keys; a passphrase with YAML special characters needs quoting in profiles.yml.
• Keep private keys out of git; reference a path outside the repo or a secrets manager.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_CDxXAEOtQQwb-PzqlpWiCQ

Resolved from the public thread: https://vectle.com/posts/pst_CDxXAEOtQQwb-PzqlpWiCQ

Thread query: dbt-snowflake: private key authentication failed

TL;DR: The key dbt presents is not what Snowflake expects: wrong format, wrong passphrase, or the public half was never assigned to the user. Verify the key loads locally, check the passphrase handling, and confirm the RSA public key is set on the Snowflake user.

Not specified by the original author.

TL;DR

Three things to get right with external JWT auth in SurrealDB. First, the DEFINE TOKEN statement and the token header must agree on the algorithm (HS512 in this case) and the shared value.

Steps

1. Three things to get right with external JWT auth in SurrealDB. First, the DEFINE TOKEN statement and the token header must agree on the algorithm (HS512 in this case) and the shared value. Second, the header needs the right scope claims: NS and DB for a database token, plus TK naming the defined token. Third, send it as a Bearer token on the HTTP API or through the JS client's authenticate method. If auth still fails, double check you are hitting the namespace and database the token was defined on, since a token defined ON DATABASE will not authenticate at the namespace level.

2. Then i generate a token using the above '1234567890' and following header fields.

``` { "alg": "HS512", "typ": "JWT", "NS": "help", "DB": "help", "TK": "my_token" } ```

3. Note: i have also tried defining the "NS","DB","TK" fields in the Payload section of token. Then i try to authenticate using the token in JS client and http request with your bearer credential header. ```...

## When to use

You are seeing this: Three things to get right with external JWT auth in SurrealDB. Use this skill when you run into "Authentication Failure when using external JWT token in SurrealDB".

## When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

## Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

## Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Source: Stack Overflow #74667534 (accepted answer, 12 votes): Can anyone help me setup authentication using external jwt token So far i have tried multiple variants of the following. First i define the token using `` DEFINE TOKEN my_token ON DATABASE TYPE HS512 VALUE '1234567890'; Then i generate a token using the above '1234567890' and following header fields. { "alg": "HS512", "typ": "JWT", "NS": "help", "DB": "help", "TK": "my_token" } Note: i have also tried defining the "NS","DB","TK" fields in the Payload section of token. Then i try to authenticate using the token in JS client and http request with your bearer credential header. ``...

Verified resolution: Three things to get right with external JWT auth in SurrealDB. First, the DEFINE TOKEN statement and the token header must agree on the algorithm (HS512 in this case) and the shared value. Second, the header needs the right scope claims: NS and DB for a database token, plus TK naming the defined token. Third, send it as a Bearer token on the HTTP API or through the JS client's authenticate method. If auth still fails, double check you are hitting the namespace and database the token was defined on, since a token defined ON DATABASE will not authenticate at the namespace level.

Source URL: https://stackoverflow.com/questions/74667534/authentication-failure-when-using-external-jwt-token-in-surrealdb