{"record":{"id":"1b7eb7c6b8820a87","repo":"benbjohnson/litestream","slug":"abs-cannot-create-azure-blob-client-with-shared-k","errorCode":null,"errorMessage":"abs: cannot create azure blob client with shared key: %w","messagePattern":"abs: cannot create azure blob client with shared key: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"abs/replica_client.go","lineNumber":182,"sourceCode":"\t\t} else {\n\t\t\tslog.Debug(\"using SAS token authentication\")\n\t\t}\n\t\t// Strip leading \"?\" if present to avoid double \"?\"\n\t\tendpointWithSAS := fmt.Sprintf(\"%s?%s\", endpoint, strings.TrimPrefix(sasToken, \"?\"))\n\t\tclient, err = azblob.NewClientWithNoCredential(endpointWithSAS, clientOptions)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"abs: cannot create azure blob client with SAS token: %w\", err)\n\t\t}\n\t} else if accountKey != \"\" && c.AccountName != \"\" {\n\t\t// Use shared key authentication (existing behavior)\n\t\tslog.Debug(\"using shared key authentication\")\n\t\tcredential, err := azblob.NewSharedKeyCredential(c.AccountName, accountKey)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"abs: cannot create shared key credential: %w\", err)\n\t\t}\n\t\tclient, err = azblob.NewClientWithSharedKeyCredential(endpoint, credential, clientOptions)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"abs: cannot create azure blob client with shared key: %w\", err)\n\t\t}\n\t} else {\n\t\t// Use default credential chain (similar to AWS SDK default credential chain)\n\t\t// This includes:\n\t\t// - Environment variables (AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_TENANT_ID)\n\t\t// - Managed Identity (for Azure VMs, App Service, etc.)\n\t\t// - Azure CLI credentials\n\t\t// - Visual Studio Code credentials\n\t\tslog.Debug(\"using default credential chain (managed identity, Azure CLI, environment variables, etc.)\")\n\t\tcredential, err := azidentity.NewDefaultAzureCredential(nil)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"abs: cannot create default azure credential: %w\", err)\n\t\t}\n\t\tclient, err = azblob.NewClient(endpoint, credential, clientOptions)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"abs: cannot create azure blob client with default credential: %w\", err)\n\t\t}\n\t}","sourceCodeStart":164,"sourceCodeEnd":200,"githubUrl":"https://github.com/benbjohnson/litestream/blob/4ed7a308f6271ebfd2b0a6e4b70b03011a37e4a3/abs/replica_client.go#L164-L200","documentation":"After a shared-key credential is built, Init creates the Azure blob client via azblob.NewClientWithSharedKeyCredential. If the SDK cannot construct a client (typically a malformed endpoint URL), the failure is wrapped with this prefix and returned from Init.","triggerScenarios":"Shared-key auth path where the endpoint string is invalid for the SDK client constructor — e.g. missing scheme (myaccount.blob.core.windows.net instead of https://...), trailing garbage, or an unparseable custom endpoint.","commonSituations":"Setting a custom endpoint without https:// (common in Azure Government/China or Azurite setups); a derived endpoint with an account name containing invalid URL characters; config value with stray quotes or spaces.","solutions":["Ensure the endpoint includes the scheme: endpoint: https://myaccount.blob.core.windows.net","If using Azurite or Azure Government, set a valid full URL (e.g. http://127.0.0.1:10000/myaccount or https://<account>.blob.core.usgovcloudapi.net)","Check the account-name for characters that would break URL construction","Verify the resolved endpoint value in logs before calling Init"],"exampleFix":"// before (config)\nendpoint: myaccount.blob.core.windows.net\n// after\nendpoint: https://myaccount.blob.core.windows.net","handlingStrategy":"validation","validationCode":"u, err := url.Parse(endpoint)\nif err != nil || u.Scheme == \"\" || u.Host == \"\" {\n    return fmt.Errorf(\"invalid ABS endpoint %q (need scheme + host)\", endpoint)\n}","typeGuard":null,"tryCatchPattern":"if err := c.Init(ctx); err != nil {\n    if strings.Contains(err.Error(), \"with shared key\") {\n        // fix endpoint URL scheme/host, then retry Init\n    }\n    return err\n}","preventionTips":["Always include https:// in the endpoint","For Azurite/Government clouds use the exact full endpoint URL","Keep account names free of URL-invalid characters","Print the resolved endpoint in dry-run validation before Init"],"tags":["abs","azure","shared-key","endpoint"],"backgroundTag":"module-init-failed","analyzedSha":"4ed7a308f6271ebfd2b0a6e4b70b03011a37e4a3","analyzedAt":"2026-09-06T18:29:25.564Z","contentChangedAt":"2026-09-06T18:29:25.564Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}