benbjohnson/litestream · error

abs: cannot create azure blob client with shared key: %w

Error message

abs: cannot create azure blob client with shared key: %w

What it means

After a shared-key credential is built, Init creates the Azure blob client via azblob.NewClientWithSharedKeyCredential. If the SDK cannot construct a client (typically a malformed endpoint URL), the failure is wrapped with this prefix and returned from Init.

Source

Thrown at abs/replica_client.go:182

		} else {
			slog.Debug("using SAS token authentication")
		}
		// Strip leading "?" if present to avoid double "?"
		endpointWithSAS := fmt.Sprintf("%s?%s", endpoint, strings.TrimPrefix(sasToken, "?"))
		client, err = azblob.NewClientWithNoCredential(endpointWithSAS, clientOptions)
		if err != nil {
			return fmt.Errorf("abs: cannot create azure blob client with SAS token: %w", err)
		}
	} else if accountKey != "" && c.AccountName != "" {
		// Use shared key authentication (existing behavior)
		slog.Debug("using shared key authentication")
		credential, err := azblob.NewSharedKeyCredential(c.AccountName, accountKey)
		if err != nil {
			return fmt.Errorf("abs: cannot create shared key credential: %w", err)
		}
		client, err = azblob.NewClientWithSharedKeyCredential(endpoint, credential, clientOptions)
		if err != nil {
			return fmt.Errorf("abs: cannot create azure blob client with shared key: %w", err)
		}
	} else {
		// Use default credential chain (similar to AWS SDK default credential chain)
		// This includes:
		// - Environment variables (AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_TENANT_ID)
		// - Managed Identity (for Azure VMs, App Service, etc.)
		// - Azure CLI credentials
		// - Visual Studio Code credentials
		slog.Debug("using default credential chain (managed identity, Azure CLI, environment variables, etc.)")
		credential, err := azidentity.NewDefaultAzureCredential(nil)
		if err != nil {
			return fmt.Errorf("abs: cannot create default azure credential: %w", err)
		}
		client, err = azblob.NewClient(endpoint, credential, clientOptions)
		if err != nil {
			return fmt.Errorf("abs: cannot create azure blob client with default credential: %w", err)
		}
	}

View on GitHub (pinned to 4ed7a308f6)

Solutions

1. Ensure the endpoint includes the scheme: endpoint: https://myaccount.blob.core.windows.net
2. If using Azurite or Azure Government, set a valid full URL (e.g. http://127.0.0.1:10000/myaccount or https://<account>.blob.core.usgovcloudapi.net)
3. Check the account-name for characters that would break URL construction
4. Verify the resolved endpoint value in logs before calling Init

Example fix

// before (config)
endpoint: myaccount.blob.core.windows.net
// after
endpoint: https://myaccount.blob.core.windows.net

u, err := url.Parse(endpoint)
if err != nil || u.Scheme == "" || u.Host == "" {
    return fmt.Errorf("invalid ABS endpoint %q (need scheme + host)", endpoint)
}

if err := c.Init(ctx); err != nil {
    if strings.Contains(err.Error(), "with shared key") {
        // fix endpoint URL scheme/host, then retry Init
    }
    return err
}

When it happens

Trigger: Shared-key auth path where the endpoint string is invalid for the SDK client constructor — e.g. missing scheme (myaccount.blob.core.windows.net instead of https://...), trailing garbage, or an unparseable custom endpoint.

Common situations: Setting a custom endpoint without https:// (common in Azure Government/China or Azurite setups); a derived endpoint with an account name containing invalid URL characters; config value with stray quotes or spaces.

Related errors

• abs: account name is required when endpoint is not specified
• abs: cannot create shared key credential: %w
• bucket required for abs replica URL
• abs: container name is required
• abs: cannot create azure blob client with SAS token: %w

AI-assisted analysis of benbjohnson/litestream@4ed7a308f6 (2026-09-06). Data as JSON: /api/errors/1b7eb7c6b8820a87. Report an issue: GitHub.