## TL;DR
With key-pair auth, the Snowflake connector signs a JWT that Snowflake accepts for a limited lifetime. When the task fails on expiry, the usual causes are a long queued task reusing a stale signed value through a cached connection, the public key fingerprint on the Snowflake user no longer matching the private key in the Airflow connection, or worker clock skew. Rotate or re-register the key pair, point the connection at the current private key, and sync worker time.

```text
airflow SnowflakeOperator failed: JWT token expired
```

## Use this when
- SnowflakeOperator tasks fail with a JWT expired style error from the connector.
- The failure started after a key rotation on the Snowflake user.
- Tasks that queue for a long time fail while quick tasks using the same connection succeed.

## Not for this skill when
- The connection uses a password or an external OAuth flow. There is no signed JWT to expire.
- Snowflake rejects the key fingerprint outright at login. That is an unregistered key, a step before expiry.

## Steps
1. Read the full connector error in the task log and note whether it says expired, invalid fingerprint, or malformed. Note the exact wording before changing anything. Verify: expiry is distinguished from an unregistered key
2. On the Snowflake user, list the RSA public key fingerprints and compare them with the fingerprint of the private key file the Airflow connection references. Note any mismatch. Verify: the key pair in use is confirmed against the registered key
3. If the pair rotated, update the Airflow connection to the current private key, stored through your credential store rather than pasted into the DAG, and re-register the matching public key on the user if needed. Note the connection test passes. Verify: the connection signs with the current key
4. Check worker clock time against a reliable time source and fix skew, because a signed JWT judged against a drifted clock looks expired early. Note the offset you found. Verify: worker time is within a few seconds of real time
5. Clear and rerun one failed task and confirm the log shows a fresh authentication and the query executing. Note the run is green. Verify: a new task authenticates and runs

## Variant phrasings
### snowflake key pair auth JWT expired airflow
The auth-method phrasing.
### SnowflakeOperator 390144 JWT token expired
The numeric Snowflake error code version, commonly reported alongside this failure.

Compatibility: Airflow Snowflake provider with snowflake-connector-python, key-pair authentication. Short lived JWT behaviour is a Snowflake platform rule, not an Airflow setting.

## Why it happens
Key-pair auth avoids storing a Snowflake password, but it trades a static credential for a signed assertion with a short life. The connector builds that assertion at connection time from the private key in the Airflow connection. Anything that breaks the assumptions behind it, a rotated key that was only half updated, a cached or long delayed connection attempt, a worker clock running minutes fast, surfaces as an expired or invalid JWT even though nothing about the SQL changed. The task code is the last place to look.

## Edge cases / pitfalls
- Snowflake supports two active public keys on a user for rotation. Register the new key before retiring the old one to avoid an outage window.
- An encrypted private key also needs its passphrase supplied in the connection. A missing passphrase fails differently, so read the error before rotating.
- Managed Airflow services may cache connections. After updating a connection, a fresh task, not a retry of a long running one, is the honest test.
- Never print the private key or the signed assertion into task logs while debugging. Log the fingerprint only.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_PF0DMCUf-risWtfSASurTQ