{"record":{"id":"e50ee0b8a11018ef","repo":"argoproj/argo-workflows","slug":"unable-to-create-azure-shared-key-credential-w","errorCode":null,"errorMessage":"unable to create Azure shared key credential: %w","messagePattern":"unable to create Azure shared key credential: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"workflow/artifacts/azure/azure.go","lineNumber":78,"sourceCode":"\tif azblobDriver.AccountKey == \"\" {\n\t\treturn nil, fmt.Errorf(\"accountKey secret is required for Azure Blob Storage if useSDKCreds is false\")\n\t}\n\n\tif isSASAccountKey(azblobDriver.AccountKey) {\n\t\tlogger := logging.RequireLoggerFromContext(ctx)\n\t\tlogger.Info(ctx, \"Provided account key is a SAS token. Using no-credential client.\")\n\t\tserviceURL := fmt.Sprintf(\"%s?%s\", containerURL.String(), azblobDriver.AccountKey)\n\t\tcontainerClient, clientErr := container.NewClientWithNoCredential(serviceURL, nil)\n\t\treturn containerClient, clientErr\n\t}\n\n\taccountName, err := determineAccountName(containerURL)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tcredential, err := azblob.NewSharedKeyCredential(accountName, azblobDriver.AccountKey)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"unable to create Azure shared key credential: %w\", err)\n\t}\n\tcontainerClient, err := container.NewClientWithSharedKeyCredential(containerURL.String(), credential, nil)\n\treturn containerClient, err\n}\n\n// determineAccountName determines the account name of the storage account based on the\n// supplied container URL.\nfunc determineAccountName(containerURL *url.URL) (string, error) {\n\thostname := containerURL.Hostname()\n\tif strings.HasPrefix(hostname, \"127.0.0.1\") || strings.HasPrefix(hostname, \"localhost\") {\n\t\tparts := strings.Split(containerURL.Path, \"/\")\n\t\tif len(parts) <= 2 {\n\t\t\treturn \"\", fmt.Errorf(\"unable to determine storage account name from %s\", containerURL)\n\t\t}\n\t\treturn parts[1], nil\n\t}\n\tparts := strings.Split(hostname, \".\")\n\treturn parts[0], nil","sourceCodeStart":60,"sourceCodeEnd":96,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/workflow/artifacts/azure/azure.go#L60-L96","documentation":"After endpoint parsing and account-name detection, the driver builds an azblob.NewSharedKeyCredential(accountName, accountKey); azidentity rejects keys that are not valid base64-encoded 64-byte storage keys, producing this wrapped error.","triggerScenarios":"accountKey is not a valid base64 storage account key (e.g. it is actually a SAS token that failed the isSASAccountKey heuristic, a connection string, or a truncated/whitespace-corrupted key), or accountName derived from the endpoint is empty.","commonSituations":"Pasted a SAS token into accountKey where it wasn't recognized as such; used the connection string instead of just the key; account name could not be derived from a custom-domain endpoint.","solutions":["Copy only the raw base64 'key' value from the Azure portal (Storage account → Access keys), not the connection string or SAS token.","If authenticating with a SAS token, append it to the endpoint URL instead of accountKey so the no-credential path is used.","Ensure the endpoint hostname encodes the account name (e.g. https://<account>.blob.core.windows.net) so determineAccountName succeeds.","Check for trailing whitespace/newlines in the secret value."],"exampleFix":"// before — accountKey secret\naccount-key: DefaultEndpointsProtocol=https;AccountName=acct;AccountKey=abc...==\n// after — key only\naccount-key: abc...base64key...==","handlingStrategy":"validation","validationCode":"func validateAccountKey(key string) error {\n\tb, err := base64.StdEncoding.DecodeString(strings.TrimSpace(key))\n\tif err != nil || len(b) != 64 {\n\t\treturn fmt.Errorf(\"accountKey must be the base64 storage access key (64 decoded bytes), not a connection string or SAS token\")\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"credential, err := azblob.NewSharedKeyCredential(accountName, key)\nif err != nil {\n\treturn fmt.Errorf(\"check accountKey value (base64 key only, not connection string/SAS): %w\", err)\n}","preventionTips":["Copy only the raw base64 key from Storage account → Access keys.","For SAS tokens, embed them in the endpoint URL, not accountKey.","Trim whitespace when writing the key into the k8s secret."],"tags":["azure","authentication","credentials"],"backgroundTag":"invalid-azure-account-key","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}