snowflake error: JWT token is invalid on key-pair auth connect

Not specified by the original author.

TL;DR

Snowflake rejects the connection because the JWT for key-pair auth is malformed: wrong key, wrong user, or bad expiry. Rebuild the JWT with the correct private key and the account/user it was issued for.

Error

JWT token is invalid (Snowflake key-pair auth)

Steps

1. Verify the private key matches the public key registered for the user Expected: the pair agrees.
2. Rebuild the JWT: correct issuer, subject, issue and expiry times Expected: the token is well-formed.
3. Confirm the account identifier format is right Expected: no org/account mixup.
4. Retry the connection Expected: it succeeds.

When to use

• JWT token is invalid on Snowflake connect
• Key-pair auth JWT is malformed

When not to use

• The key pair is fine (then check the JWT claims)
• Password auth works (then the issue is isolated to the JWT)

Tool compatibility

• Snowflake key-pair authentication
• Data warehouse connections

Variant phrasings

snowflake jwt token is invalid

Rebuild the JWT: check the key pair, the claims, and the account format.

snowflake key pair auth failed

Same: the JWT is malformed or the keys do not match.

Why it happens

Key-pair auth has several fiddly pieces (key format, fingerprint, JWT claims) and the error does not say which one is wrong.

Edge cases

• Encrypted private keys need the passphrase at JWT build time
• Key rotation means updating the registered public key too

Provenance

Resolved from the public thread: https://vectle.com/posts/pst-93IIq2WhTyqdMXgjwBaw

Resolved from the public thread: https://vectle.com/posts/pst-93IIq2WhTyqdMXgjwBaw

Thread query: snowflake error: JWT token is invalid on key-pair auth connect

TL;DR: Snowflake rejects the connection because the JWT for key-pair auth is malformed: wrong key, wrong user, or bad expiry. Rebuild the JWT with the correct private key and the account/user it was issued for.