benbjohnson/litestream · error

abs: cannot create azure blob client with default credential

Error message

abs: cannot create azure blob client with default credential: %w

What it means

The Azure Blob Service client could not be constructed from the default credential chain in abs.ReplicaClient.Init. The credential itself resolved, but building the azblob client with it failed, typically because the endpoint/account URL is malformed or unreachable DNS-wise during client construction.

Source

Thrown at abs/replica_client.go:198

		client, err = azblob.NewClientWithSharedKeyCredential(endpoint, credential, clientOptions)
		if err != nil {
			return fmt.Errorf("abs: cannot create azure blob client with shared key: %w", err)
		}
	} else {
		// Use default credential chain (similar to AWS SDK default credential chain)
		// This includes:
		// - Environment variables (AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_TENANT_ID)
		// - Managed Identity (for Azure VMs, App Service, etc.)
		// - Azure CLI credentials
		// - Visual Studio Code credentials
		slog.Debug("using default credential chain (managed identity, Azure CLI, environment variables, etc.)")
		credential, err := azidentity.NewDefaultAzureCredential(nil)
		if err != nil {
			return fmt.Errorf("abs: cannot create default azure credential: %w", err)
		}
		client, err = azblob.NewClient(endpoint, credential, clientOptions)
		if err != nil {
			return fmt.Errorf("abs: cannot create azure blob client with default credential: %w", err)
		}
	}

	c.client = client
	return nil
}

// LTXFiles returns an iterator over all available LTX files.
// Azure always uses accurate timestamps from metadata since they're included in LIST operations at zero cost.
// The useMetadata parameter is ignored.
func (c *ReplicaClient) LTXFiles(ctx context.Context, level int, seek ltx.TXID, useMetadata bool) (ltx.FileIterator, error) {
	if err := c.Init(ctx); err != nil {
		return nil, err
	}
	return newLTXFileIterator(ctx, c, level, seek), nil
}

// WriteLTXFile writes an LTX file to remote storage.

View on GitHub (pinned to 4ed7a308f6)

Solutions

1. Verify the endpoint URL (abs://account.blob.core.windows.net or custom endpoint) is well-formed
2. Confirm the account name is correct and the storage account exists
3. Check network/DNS access to the endpoint

When it happens

Trigger: Thrown at abs/replica_client.go:198 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of benbjohnson/litestream@4ed7a308f6 (2026-09-06). Data as JSON: /api/errors/dec495895c422228. Report an issue: GitHub.