{"record":{"id":"8e50a1a62f1cdc4f","repo":"benbjohnson/litestream","slug":"abs-cannot-create-shared-key-credential-w","errorCode":null,"errorMessage":"abs: cannot create shared key credential: %w","messagePattern":"abs: cannot create shared key credential: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"abs/replica_client.go","lineNumber":178,"sourceCode":"\tif sasToken != \"\" {\n\t\t// SAS token authentication - append token to endpoint URL\n\t\tif accountKey != \"\" {\n\t\t\tslog.Warn(\"both SAS token and account key configured, using SAS token\")\n\t\t} else {\n\t\t\tslog.Debug(\"using SAS token authentication\")\n\t\t}\n\t\t// Strip leading \"?\" if present to avoid double \"?\"\n\t\tendpointWithSAS := fmt.Sprintf(\"%s?%s\", endpoint, strings.TrimPrefix(sasToken, \"?\"))\n\t\tclient, err = azblob.NewClientWithNoCredential(endpointWithSAS, clientOptions)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"abs: cannot create azure blob client with SAS token: %w\", err)\n\t\t}\n\t} else if accountKey != \"\" && c.AccountName != \"\" {\n\t\t// Use shared key authentication (existing behavior)\n\t\tslog.Debug(\"using shared key authentication\")\n\t\tcredential, err := azblob.NewSharedKeyCredential(c.AccountName, accountKey)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"abs: cannot create shared key credential: %w\", err)\n\t\t}\n\t\tclient, err = azblob.NewClientWithSharedKeyCredential(endpoint, credential, clientOptions)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"abs: cannot create azure blob client with shared key: %w\", err)\n\t\t}\n\t} else {\n\t\t// Use default credential chain (similar to AWS SDK default credential chain)\n\t\t// This includes:\n\t\t// - Environment variables (AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_TENANT_ID)\n\t\t// - Managed Identity (for Azure VMs, App Service, etc.)\n\t\t// - Azure CLI credentials\n\t\t// - Visual Studio Code credentials\n\t\tslog.Debug(\"using default credential chain (managed identity, Azure CLI, environment variables, etc.)\")\n\t\tcredential, err := azidentity.NewDefaultAzureCredential(nil)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"abs: cannot create default azure credential: %w\", err)\n\t\t}\n\t\tclient, err = azblob.NewClient(endpoint, credential, clientOptions)","sourceCodeStart":160,"sourceCodeEnd":196,"githubUrl":"https://github.com/benbjohnson/litestream/blob/4ed7a308f6271ebfd2b0a6e4b70b03011a37e4a3/abs/replica_client.go#L160-L196","documentation":"Init builds a shared-key credential from the account name and account key via azblob.NewSharedKeyCredential. The Azure SDK rejects malformed credentials (e.g. an account key that is not valid base64), and Init wraps that failure with this prefix.","triggerScenarios":"Shared-key auth is selected (account key + account name configured) but NewSharedKeyCredential fails — most commonly the account key is truncated, contains whitespace/newlines, or is not valid base64.","commonSituations":"Copying the storage account key with a missing character or trailing newline; using a connection-string fragment instead of the raw key; secret manager returning an escaped/mangled key value.","solutions":["Re-copy the storage account key from Azure (Storage account > Access keys) and ensure it is complete base64 with no whitespace","Trim newlines/quotes from the key value in your env or secret store","Confirm you are using the account key, not a connection string or SAS token, for shared-key auth","If the key cannot be fixed, fall back to SAS token or default credential chain"],"exampleFix":"// before\nexport LITESTREAM_ABS_ACCOUNT_KEY=\"<truncated-key>\n\"\n// after (trim and verify base64)\nexport LITESTREAM_ABS_ACCOUNT_KEY=$(echo \"$RAW_KEY\" | tr -d '\\n\\r\" ')","handlingStrategy":"validation","validationCode":"if key := os.Getenv(\"LITESTREAM_ABS_ACCOUNT_KEY\"); key != \"\" {\n    if _, err := base64.StdEncoding.DecodeString(strings.TrimSpace(key)); err != nil {\n        return fmt.Errorf(\"account key is not valid base64: %w\", err)\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Copy the full raw account key (no truncation, no quotes, no newline)","Use the account key, not a connection string, for shared-key auth","Store the key in a secret manager and verify round-trip integrity","Base64-decode it once as a smoke test in deployment scripts"],"tags":["abs","azure","shared-key","credentials"],"backgroundTag":"invalid-argument-value","analyzedSha":"4ed7a308f6271ebfd2b0a6e4b70b03011a37e4a3","analyzedAt":"2026-09-06T18:29:25.564Z","contentChangedAt":"2026-09-06T18:29:25.564Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}