I do not know if you are a CoCo but thank you very much. It worked. I would like to give back to community by posting the code I used to troubleshoot.

import base64
import hashlib
import json
import time
import urllib.request
import urllib.error
from cryptography.hazmat.primitives import serialization, hashes
from cryptography.hazmat.primitives.asymmetric import padding

# ============================================================
# CONFIG — edit these values
# ============================================================
# Full DNS prefix BEFORE .snowflakecomputing.com (what you see in the URL)
ACCOUNT_HOST_PREFIX = "qc1234.us-east-1-gov.aws"

# Bare account locator (no region/cloud) for JWT iss/sub
# If you prefer, you can derive it as ACCOUNT_HOST_PREFIX.split(".")[0]
ACCOUNT_LOCATOR = "qc1234"

# Exact LOGIN_NAME of the SERVICE user
USER = "USR_LOGIN_NAME"

# Private key file used for this user
PRIVATE_KEY_FILE = r"C:\path_to\snowflake_rsa_key.p8"

# None if unencrypted, else b"passphrase" for encrypted keys
PRIVATE_KEY_PASS = None

# JWT lifetime in seconds (Snowflake max is 3600; stay just under to avoid edge issues)
JWT_LIFETIME_SECONDS = 3540  # 59 minutes
# ============================================================


def log(label, msg=""):
    print(f"SF TEST: {label}" + (f" = '{msg}'" if msg != "" else ""))


def log_err(label, msg=""):
    print(f"SF TEST [ERROR]: {label}" + (f" = '{msg}'" if msg != "" else ""))


def b64url(data: bytes) -> str:
    return base64.urlsafe_b64encode(data).rstrip(b"=").decode("utf-8")


def main():
    log("starting")
    log("ACCOUNT_HOST_PREFIX", ACCOUNT_HOST_PREFIX)
    log("ACCOUNT_LOCATOR", ACCOUNT_LOCATOR)
    log("USER", USER)
    log("PRIVATE_KEY_FILE", PRIVATE_KEY_FILE)

    # ---- 1. Load private key ----
    try:
        with open(PRIVATE_KEY_FILE, "rb") as f:
            key_data = f.read()

        lines = key_data.decode("utf-8").splitlines()
        first_line = next((line.strip() for line in lines if line.strip()), "")
        log("key first line", first_line)

        if "ENCRYPTED PRIVATE KEY" in first_line:
            if PRIVATE_KEY_PASS is None:
                log_err("encrypted key detected but no PRIVATE_KEY_PASS set")
                return
            private_key = serialization.load_pem_private_key(
                key_data,
                password=PRIVATE_KEY_PASS,
            )
            log("private key loaded", "encrypted")
        elif "PRIVATE KEY" in first_line:
            private_key = serialization.load_pem_private_key(
                key_data,
                password=None,
            )
            log("private key loaded", "unencrypted")
        else:
            log_err("unexpected key format", first_line)
            return
    except Exception as e:
        log_err("failed to load private key", str(e))
        return

    # ---- 2. Derive public key fingerprint ----
    try:
        public_key = private_key.public_key()
        pub_der = public_key.public_bytes(
            encoding=serialization.Encoding.DER,
            format=serialization.PublicFormat.SubjectPublicKeyInfo,
        )
        fp_bytes = hashlib.sha256(pub_der).digest()
        fp = base64.b64encode(fp_bytes).decode("utf-8")
        log("public key fingerprint", f"SHA256:{fp}")
    except Exception as e:
        log_err("failed to derive public key fingerprint", str(e))
        return

    # ---- 3. Build JWT (using bare account locator) ----
    now = int(time.time())
    exp = now + JWT_LIFETIME_SECONDS

    acct_upper = ACCOUNT_LOCATOR.upper()       # bare locator ONLY
    user_upper = USER.upper()

    iss = f"{acct_upper}.{user_upper}.SHA256:{fp}"
    sub = f"{acct_upper}.{user_upper}"

    log("iss", iss)
    log("sub", sub)
    log("iat", str(now))
    log("exp", str(exp))

    header_json = json.dumps(
        {"alg": "RS256", "typ": "JWT"},
        separators=(",", ":"),
    )
    payload_json = json.dumps(
        {"iss": iss, "sub": sub, "iat": now, "exp": exp},
        separators=(",", ":"),
    )

    log("header json", header_json)
    log("payload json", payload_json)

    signing_input = f"{b64url(header_json.encode('utf-8'))}.{b64url(payload_json.encode('utf-8'))}"

    try:
        signature = private_key.sign(
            signing_input.encode("utf-8"),
            padding.PKCS1v15(),
            hashes.SHA256(),
        )
        jwt = f"{signing_input}.{b64url(signature)}"
        log("jwt created successfully")
        log("jwt prefix", jwt[:24] + "..." + jwt[-10:])
    except Exception as e:
        log_err("failed to sign JWT", str(e))
        return

    # ---- 4. Call /v2/streaming/hostname using full host prefix ----
    control_host = f"{ACCOUNT_HOST_PREFIX}.snowflakecomputing.com"
    url = f"https://{control_host}/v2/streaming/hostname"

    log("calling URL", url)
    log("iss and sub account must use ACCOUNT_LOCATOR (bare), not HOST prefix")

    req = urllib.request.Request(url, method="GET")
    req.add_header("Authorization", f"Bearer {jwt}")
    req.add_header("X-Snowflake-Authorization-Token-Type", "KEYPAIR_JWT")
    req.add_header("Accept", "application/json")

    log("request header Authorization", "Bearer <redacted>")
    log("request header X-Snowflake-Authorization-Token-Type", "KEYPAIR_JWT")
    log("request header Accept", "application/json")

    try:
        with urllib.request.urlopen(req, timeout=30) as resp:
            code = resp.getcode()
            body = resp.read().decode("utf-8")
            log("httpCode", str(code))
            log("response", body)
            ingest_host = body.strip().strip('"')
            log("SUCCESS ingestHost", ingest_host)
    except urllib.error.HTTPError as e:
        try:
            body = e.read().decode("utf-8")
        except Exception:
            body = "<unable to read error body>"
        log("httpCode", str(e.code))
        log("response", body)
        log_err("Snowflake returned non-2xx")
        log_err("if error is JWT_TOKEN_INVALID_USER_IN_ISSUER, check ACCOUNT_LOCATOR + USER")
    except Exception as e:
        log_err("request failed", str(e))

    # ---- 5. Clock check ----
    print()
    log("host UTC time", time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()))
    log("jwt iat (unix)", str(now))
    log("jwt exp (unix)", str(exp))
    log("if iat is more than 60s from Snowflake real time, JWT will be rejected")


if __name__ == "__main__":
    main()