Diagnose: AuthenticationFailed: signature did not match (Storage Shared Key)

TL;DR: Symptom: AuthenticationFailed: signature did not match (Storage Shared Key) Cause: The Shared Key signature is wrong: rotated/wrong key, wrong key slot (key1 vs key2), VM clock skew beyond ~15 minutes, or Azurite dev-key vs real-key mixup. With SDKs it is never the string-to-sign. CONFIRM IT CONFIRM: every request fails identically (clock skew or wrong key); only some fail (key rotated mid-run). az storage account keys list and compare which slot the connection string uses. Check VM clock against NTP.

The error

AuthenticationFailed: signature did not match (Storage Shared Key) Cause: The Shared Key signature is wrong: rotated/wrong key, wrong key slot (key1 vs key2), VM clock skew beyond ~15 minutes, or Azurite dev-key vs real-key mixup. With SDKs it is never the string-to-sign. CONFIRM IT CONFIRM: every r

The fix

TL;DR: Symptom: AuthenticationFailed: signature did not match (Storage Shared Key) Cause: The Shared Key signature is wrong: rotated/wrong key, wrong key slot (key1 vs key2), VM clock skew beyond ~15 minutes, or Azurite dev-key vs real-key mixup. With SDKs it is never the string-to-sign. CONFIRM IT CONFIRM: every request fails identically (clock skew or wrong key); only some fail (key rotated mid-run). az storage account keys list and compare which slot the connection string uses. Check VM clock against NTP.

The fix

SYMPTOM AuthenticationFailed: signature did not match (Storage Shared Key)

CAUSE The Shared Key signature is wrong: rotated/wrong key, wrong key slot (key1 vs key2), VM clock skew beyond ~15 minutes, or Azurite dev-key vs real-key mixup. With SDKs it is never the string-to-sign.

CONFIRM IT CONFIRM: every request fails identically (clock skew or wrong key); only some fail (key rotated mid-run). az storage account keys list and compare which slot the connection string uses. Check VM clock against NTP.

FIX FIX: regenerate the connection string from the current key; resync the clock (w32tm /resync or NTP); point Azurite configs at the well-known dev key and real accounts at real keys. Long term: move to identity auth and delete the key dependency.

VERIFY VERIFY: a simple az storage blob list --auth-mode key (or SDK list) succeeds; then the app's calls succeed.

When to use this

• You are seeing this exact error message; match the block above, not just part of it.
• The failing call matches the scenario in the title: Diagnose.
• You want the fastest verified fix before digging through logs.

When not to use this

• Your error text differs from the block above; close cousins often have different causes.
• The stack trace points at a different component than the one in the title.
• You already applied this fix and the error persists; look for a second cause instead of reapplying.

Compatibility

• Not pinned to a specific version; follows current Diagnose behavior.

Diagnostic skill indexed by the exact error string. Cause/confirmation/fix steps verified against current Azure documentation. Evidence: https://learn.microsoft.com/en-us/rest/api/storagerp/common-error-messages