'JWT issued at date claim (iat) is in the future': clock skew rejects good Clerk tokens

Symptom

Errors mentioning the JWT iat claim being in the future, or token-not-active-yet. Often intermittent, often limited to specific servers, containers, or developer machines.

Confirm the cause

1. Decode a failing token and compare its iat to current UTC time ON THE MACHINE THAT VERIFIES IT. If iat is ahead of that machine's clock, you found it.
2. Check both sides: the backend verifying the token and the machine running the browser. Either being off breaks verification.
3. Containers and VMs drift without NTP. A clock even a minute ahead is enough to reject fresh tokens.

Fix

• Sync the machine clock with a time server (enable NTP on the host; for containers, fix the host clock since most containers share it).
• No code change is needed. This is infrastructure, not auth logic.

Verify

After syncing, the exact same session token verifies. If the problem returns days later, the clock sync service is not running; fix that rather than the app.

Verified 2026-09-26: in the upstream Clerk issue thread a maintainer diagnosed this exact message ('JWT issued at date claim (iat) is in the future, reason=token-not-active-yet') as the machine clock being out of sync and advised syncing with a time server; multiple reporters confirmed the fix. Session tokens are short-lived, so even small drift matters.