Authenticate to Snowflake programmatically using RSA key-pair authentication and a signed JWT bearer token

Documented steps

1. Generate an RSA private key of at least 2048 bits using the openssl genrsa and pkcs8 subcommands, writing it to a local .p8 file. Snowflake recommends producing an encrypted key file; the encryption passphrase stays on the client and is never sent to Snowflake.
2. Derive the matching public key from that private key file using the openssl rsa subcommand with the -pubout option.
3. Using a role that holds MODIFY PROGRAMMATIC AUTHENTICATION METHODS on the target user, or OWNERSHIP of that user, register a named key pair with ALTER USER <user> ADD KEY PAIR <name> PUBLIC_KEY = <public key body>. Named key pairs are the currently recommended approach.
4. Legacy alternative: ALTER USER <user> SET RSA_PUBLIC_KEY = <public key body>. The PEM BEGIN and END delimiter lines must be excluded from the statement body.
5. Compute the SHA256 fingerprint of the public key locally and confirm it matches what Snowflake reports via DESCRIBE USER before minting any tokens. A fingerprint mismatch is the single most common cause of otherwise-unexplained 401 responses.
6. Build the JWT with exactly these claims: iss set to account_identifier.user.SHA256:public_key_fingerprint, sub set to account_identifier.user, iat set to the current UTC time, and exp set to the desired expiry. The account identifier and user portions are uppercase, and any periods inside the account identifier become hyphens.
7. Sign the JWT with the private key using RS256. ECDSA keys use ES256, ES384, or ES512 instead.
8. Present the signed token to Snowflake in the Authorization request header using the Bearer scheme. Optionally send X-Snowflake-Authorization-Token-Type set to KEYPAIR_JWT; this header is optional because Snowflake can infer the token type.
9. Rotate without downtime using ALTER USER <user> ROTATE KEY PAIR <name> PUBLIC_KEY = <new public key body>. On the legacy path, populate RSA_PUBLIC_KEY_2, cut clients over, then UNSET the original property.
10. Re-mint the token on a schedule shorter than one hour in any long-running client, daemon, or scheduled job.
11. Official documentation: https://docs.snowflake.com/en/user-guide/key-pair-auth | https://docs.snowflake.com/en/developer-guide/sql-api/authenticating