Yes: if your laptop generated the Google service-account JWT assertion, a clock three days slow can make its iat and exp claims fall outside Google’s acceptable time window and trigger invalid_grant. Correct and synchronize the clock on the system that creates the assertion, mint a fresh JWT, and retry. This explanation fits Google’s specific “Invalid JWT” time-window error; invalid_grant by itself does not prove a clock problem or that the service-account credentials are otherwise correct.
When a slow clock explains invalid_grant
This diagnosis applies to Google’s service-account flow in which an application signs a JWT assertion and exchanges it at the OAuth token endpoint. Google’s troubleshooting table says that the error “Invalid JWT: Token must be a short-lived token (60 minutes) and in a reasonable timeframe” usually means the local system time is incorrect. A three-day offset is far outside a reasonable timeframe, if the slow laptop was the machine that generated the assertion. Google’s service-account OAuth guide gives the flow-specific error and remedy.
As an Amazon Associate I earn from qualifying purchases.
The laptop does not have to be where the application runs or where you inspect the service-account settings. What matters is the clock on the system that created the signed assertion. If a server, container, or another runtime generated it, check that environment’s clock instead.
Check the JWT before changing other credentials
Decode the assertion payload locally and inspect the time and identity claims. The payload is not encrypted, but the signed assertion is a live credential: do not paste it or your private key into a public decoder.
#1 Best Overall
- Up to 6000 visits per second
- Local area network synchronization timing accuracy: 0.5-2ms
- Support GPS, Beidou, GLONASS, QZSS NTP v2 (RFC 1119), NTP v3 (RFC 1305), NTP v4 (RFC5905)
- Internally integrated high- timing GNSS satellite receiver
- SNTP v3 (RFC 1769), SNTP v4 (RFC 2030)
iatis the issued-at time, andexpis the expiration time. Both are Unix epoch seconds. Check that they correspond to the intended current time, thatexpis later thaniat, and that the assertion’s lifetime is within Google’s limit.issidentifies the service account. Confirm it is the intended account.audfor this access-token request must behttps://oauth2.googleapis.com/token.scopemust contain the requested scope or scopes. If using domain-wide delegation, verify the delegated user’ssubas well.
Google documents a maximum assertion lifetime of one hour. Its troubleshooting guidance also identifies an exp more than 65 minutes after iat, or an exp earlier than iat, as conditions that can produce the error. The 65-minute condition is a diagnostic threshold in that guidance—not a general allowance for clock skew. See Google Cloud’s token-types documentation for additional claim and lifetime context.
Fix the clock and retry with a new assertion
- Identify the exact grant flow and the machine or runtime that generated the JWT. Compare its underlying system time with trusted current UTC; a display timezone mismatch is different from a clock that is actually behind.
- Correct and synchronize time on that assertion-generating system. Google recommends syncing with Google NTP if necessary.
- Generate a fresh signed assertion after the clock is corrected. An assertion minted with the wrong time claims will not be repaired by changing the clock afterward.
- Retry the token exchange. If the same error persists, inspect the claims and signing configuration rather than assuming the clock was the only fault. Google’s service-account guidance also lists invalid subject email and invalid JWT signature as causes.
If the assertion format or claims remain suspect, use a Google-provided OAuth library to create the assertion instead of maintaining the JWT construction yourself. Google’s own guidance is the authority for this flow; RFC 7523 supplies the broader standard for JWT assertions in OAuth, but does not replace Google’s flow-specific requirements.
Rank #2
- Stratum 1 NTP with GPS Source
- Embedded View-only Webserver with Status & Graphs
- Admin Console via USB and SSH
- JSON Encoded Raw Data for Custom Integration
- I/O Connector
Do not apply the clock diagnosis to every invalid_grant
Google also uses invalid_grant in its web-server authorization-code and refresh-token flow for different problems, including an expired or invalidated authorization code or refresh token. If your application is exchanging one of those credentials rather than a signed service-account assertion, follow the error guidance for that flow; the service-account clock explanation may not apply. See Google’s web-server OAuth guide.
The OAuth error label alone cannot establish that a service account is “fine.” Use the complete error description, confirm which flow is running, and check the actual claims before ruling out a wrong subject, malformed claim, or signature problem.
Quick Recap
Best Value
- 1. GPS Satellite Time Synchronization: This NTP server receives global time signals from GPS satellites, ensuring nanosecond-level time synchronization accuracy, providing high reliability for your network equipment.
- 2. High-Precision NTP Service: Provides SNTP/NTP time synchronization with Daylight Saving Time (DST) support for finance, communications, and government.
- 3. Low Latency and High Performance: Optimized design with ultra-low network latency, ensuring multi-device sync accuracy to the millisecond level, ideal for applications where time precision is critical.
- 4.Flexible Dual-Power Deployment: Supports either AC power (wide voltage input 110V-264V) or standard PoE (IEEE 802.3af/at).
- 5. Easy-to-Use Web Management Interface: Supports easy installation and remote management. The intuitive interface makes it easy to monitor device status, configure settings, and maintain the system — ideal for IT administrators and technical teams.
Rank #4
- 【Supports Three Satellite Signals】– Simultaneously receives GPS, GLONASS, and BEIDOU satellite signals, providing reliable and accurate network time for all connected devices.
- 【Dual Ethernet Ports for Seamless Integration】 – Equipped with 2 Ethernet ports for smooth network integration, suitable for both small and large-scale networks.
- 【PPS + TOD Support for High-Precision Time Distribution】 – Features Pulse Per Second (PPS) and Time of Day (TOD) connectors for advanced time synchronization, meeting the needs of time-sensitive applications.
- 【Optional Dual Redundnant Power Inputs】 –Support AC & POE Power
- 【Supports Multiple Protocols】 – Compatible with various NTP network time protocols (NTP v2, v3, v4, SNTP v3, v4), ensuring your system stays synchronized across diverse platforms and networks.
Rank #3
- Stratum 1 NTP with GPS Source
- Embedded View-only Webserver with Status & Graphs
- Admin Console via USB and SSH
- Optional Dual Redundant Power Inputs - DC & PoE
- JSON Encoded Raw Data for Custom Integration
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
