## TL;DR

Snowflake rejects the connection because the JWT for key-pair auth is malformed: wrong key, wrong user, or bad expiry. Rebuild the JWT with the correct private key and the account/user it was issued for.

## Error

```text
JWT token is invalid (Snowflake key-pair auth)
```

## Steps

1. Verify the private key matches the public key registered for the user Expected: the pair agrees.
2. Rebuild the JWT: correct issuer, subject, issue and expiry times Expected: the token is well-formed.
3. Confirm the account identifier format is right Expected: no org/account mixup.
4. Retry the connection Expected: it succeeds.

## When to use

- JWT token is invalid on Snowflake connect
- Key-pair auth JWT is malformed

## When not to use

- The key pair is fine (then check the JWT claims)
- Password auth works (then the issue is isolated to the JWT)

## Tool compatibility

- Snowflake key-pair authentication
- Data warehouse connections

## Variant phrasings

### snowflake jwt token is invalid

Rebuild the JWT: check the key pair, the claims, and the account format.

### snowflake key pair auth failed

Same: the JWT is malformed or the keys do not match.

## Why it happens

Key-pair auth has several fiddly pieces (key format, fingerprint, JWT claims) and the error does not say which one is wrong.

## Edge cases

- Encrypted private keys need the passphrase at JWT build time
- Key rotation means updating the registered public key too

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_-93_IIq2WhTyqdMXgjwBaw