benbjohnson/litestream · error

abs: cannot create shared key credential: %w

Error message

abs: cannot create shared key credential: %w

What it means

Init builds a shared-key credential from the account name and account key via azblob.NewSharedKeyCredential. The Azure SDK rejects malformed credentials (e.g. an account key that is not valid base64), and Init wraps that failure with this prefix.

Source

Thrown at abs/replica_client.go:178

	if sasToken != "" {
		// SAS token authentication - append token to endpoint URL
		if accountKey != "" {
			slog.Warn("both SAS token and account key configured, using SAS token")
		} else {
			slog.Debug("using SAS token authentication")
		}
		// Strip leading "?" if present to avoid double "?"
		endpointWithSAS := fmt.Sprintf("%s?%s", endpoint, strings.TrimPrefix(sasToken, "?"))
		client, err = azblob.NewClientWithNoCredential(endpointWithSAS, clientOptions)
		if err != nil {
			return fmt.Errorf("abs: cannot create azure blob client with SAS token: %w", err)
		}
	} else if accountKey != "" && c.AccountName != "" {
		// Use shared key authentication (existing behavior)
		slog.Debug("using shared key authentication")
		credential, err := azblob.NewSharedKeyCredential(c.AccountName, accountKey)
		if err != nil {
			return fmt.Errorf("abs: cannot create shared key credential: %w", err)
		}
		client, err = azblob.NewClientWithSharedKeyCredential(endpoint, credential, clientOptions)
		if err != nil {
			return fmt.Errorf("abs: cannot create azure blob client with shared key: %w", err)
		}
	} else {
		// Use default credential chain (similar to AWS SDK default credential chain)
		// This includes:
		// - Environment variables (AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_TENANT_ID)
		// - Managed Identity (for Azure VMs, App Service, etc.)
		// - Azure CLI credentials
		// - Visual Studio Code credentials
		slog.Debug("using default credential chain (managed identity, Azure CLI, environment variables, etc.)")
		credential, err := azidentity.NewDefaultAzureCredential(nil)
		if err != nil {
			return fmt.Errorf("abs: cannot create default azure credential: %w", err)
		}
		client, err = azblob.NewClient(endpoint, credential, clientOptions)

View on GitHub (pinned to 4ed7a308f6)

Solutions

1. Re-copy the storage account key from Azure (Storage account > Access keys) and ensure it is complete base64 with no whitespace
2. Trim newlines/quotes from the key value in your env or secret store
3. Confirm you are using the account key, not a connection string or SAS token, for shared-key auth
4. If the key cannot be fixed, fall back to SAS token or default credential chain

Example fix

// before
export LITESTREAM_ABS_ACCOUNT_KEY="<truncated-key>
"
// after (trim and verify base64)
export LITESTREAM_ABS_ACCOUNT_KEY=$(echo "$RAW_KEY" | tr -d '\n\r" ')

if key := os.Getenv("LITESTREAM_ABS_ACCOUNT_KEY"); key != "" {
    if _, err := base64.StdEncoding.DecodeString(strings.TrimSpace(key)); err != nil {
        return fmt.Errorf("account key is not valid base64: %w", err)
    }
}

When it happens

Trigger: Shared-key auth is selected (account key + account name configured) but NewSharedKeyCredential fails — most commonly the account key is truncated, contains whitespace/newlines, or is not valid base64.

Common situations: Copying the storage account key with a missing character or trailing newline; using a connection-string fragment instead of the raw key; secret manager returning an escaped/mangled key value.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• abs: cannot create azure blob client with shared key: %w
• bucket required for abs replica URL
• abs: container name is required
• abs: account name is required when endpoint is not specified
• abs: cannot create azure blob client with SAS token: %w

AI-assisted analysis of benbjohnson/litestream@4ed7a308f6 (2026-09-06). Data as JSON: /api/errors/8e50a1a62f1cdc4f. Report an issue: GitHub.