home-assistant/core · error · ConfigEntryAuthFailed

invalid_auth

Error message

invalid_auth

What it means

Raised as ConfigEntryAuthFailed (translation key invalid_auth) when the Azure Blob Storage setup call fails with ClientAuthenticationError. It means the request reached the account but authentication was rejected (bad SAS token, expired key, wrong shared key, or insufficient RBAC permissions). HA marks the entry as needing re-authentication and shows a reauth flow instead of retrying.

Source

Thrown at homeassistant/components/azure_storage/__init__.py:68

            transport=AioHttpTransport(session=session),
        )

    # has a blocking call to open in cpython
    container_client: ContainerClient = await hass.async_add_executor_job(
        create_container_client
    )

    try:
        if not await container_client.exists():
            await container_client.create_container()
    except ResourceNotFoundError as err:
        raise ConfigEntryError(
            translation_domain=DOMAIN,
            translation_key="account_not_found",
            translation_placeholders={CONF_ACCOUNT_NAME: entry.data[CONF_ACCOUNT_NAME]},
        ) from err
    except ClientAuthenticationError as err:
        raise ConfigEntryAuthFailed(
            translation_domain=DOMAIN,
            translation_key="invalid_auth",
            translation_placeholders={CONF_ACCOUNT_NAME: entry.data[CONF_ACCOUNT_NAME]},
        ) from err
    except AzureError as err:
        raise ConfigEntryNotReady(
            translation_domain=DOMAIN,
            translation_key="cannot_connect",
            translation_placeholders={CONF_ACCOUNT_NAME: entry.data[CONF_ACCOUNT_NAME]},
        ) from err

    entry.runtime_data = container_client

    def _async_notify_backup_listeners() -> None:
        for listener in hass.data.get(DATA_BACKUP_AGENT_LISTENERS, []):
            listener()

    entry.async_on_unload(entry.async_on_state_change(_async_notify_backup_listeners))

View on GitHub (pinned to 58a3fdb3ea)

Solutions

1. Open the reauth prompt for the entry and re-enter a valid SAS token / connection string
2. If using keys, verify against the currently active key in the Azure portal (keys can be rotated)
3. If using Entra/managed identity, assign 'Storage Blob Data Contributor' to the identity on the account
4. Check the SAS token's expiry and allowed permissions (read/write/create container) and IP restrictions

def is_auth_error(err: BaseException) -> bool:
    from azure.core.exceptions import ClientAuthenticationError
    return isinstance(err, ClientAuthenticationError)

try:
    await container_client.exists()
except ClientAuthenticationError as err:
    # start reauth flow; do not retry with the same credentials
    raise ConfigEntryAuthFailed(...) from err

When it happens

Trigger: container_client.exists() raises azure.core.exceptions.ClientAuthenticationError (HTTP 401/403) because the SAS token is expired/malformed or the Entra identity lacks the Storage Blob Data Reader/Contributor role.

Common situations: Expired SAS token, regenerated storage keys invalidating the saved connection string, managed identity without RBAC role assignment on the storage account.

Related errors

• account_not_found
• Invalid credentials: {ex}
• auth_error
• Migration to OAuth required
• err

AI-assisted analysis of home-assistant/core@58a3fdb3ea (2026-08-14). Data as JSON: /api/errors/b0895b9d35d2de85. Report an issue: GitHub.