invalid_grant: my service account was fine. My laptop's clock was three days slow.
My daily SEO round emails me one digest. This morning it led with this: NEEDS YOU — 5 thing(s) * Search Console could not be read today. ... SEARCH CONSOLE — COULD NOT READ Token request failed (HTTP 400): {"error":"invalid_grant", "error_description":"Invalid JWT: Token must be a short-lived token (60 minutes) and in a reasonable timeframe. Check your iat and exp values in the JWT claim."}…
In the SEO round email, a digest highlighted an issue with Search Console: it could not be read today. The error detailed was an invalid_grant, which occurs when a credential is incorrect. The reporter, after six days of cleaning a compromised hosting account, realized that the issue was not with the service account but with the clock on their laptop.
The laptop's clock was three days slow. Upon checking the server's time, it was revealed that the token had been issued three days ago and had expired two days and twenty-three hours ago. This discrepancy led to the token being rejected by Google. The reporter's client, responsible for building the assertion, overlooked the clock issue.
The error message provided a precise description of the fault, but the reporter initially read it as an authorization error rather than a time-related issue. Upon further inspection, the reporter discovered that only the check with a stopwatch failed, while other checks were successful. To avoid such issues in the future, the reporter advises comparing the clock to the server's time before troubleshooting the credential.
The report also emphasized the importance of examining the token itself, as the code may appear correct, but the token reveals the actual issue.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
