Azure Storage AuthenticationFailed: signature mismatch means key or string-to-sign problem

Error text: AuthenticationFailed: Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.

With SDKs (the common case):

1. Key rotated. The connection string holds an old key. Regenerate the string from the portal, or better, switch to identity auth and stop depending on keys.
2. Wrong key slot. Storage accounts have key1/key2. The string uses key1, someone rotated key1. Use key2 while you fix, then rotate both on a schedule.
3. Clock skew. Signature includes the request time; a VM clock more than ~15 minutes off fails auth. w32tm /resync on Windows, NTP check on Linux. This one produces identical errors on every request, which is the tell.
4. Emulator mismatch. Azurite uses the well-known dev key. Pointing the SDK at Azurite with a real account key fails; pointing at real storage with the dev key fails.

With hand-rolled REST:

5. String-to-sign. Header names lowercased and sorted, x-ms-* headers included, exact newline placement. One missing header breaks the signature. Prefer the SDK; hand-rolling Shared Key auth is a bug farm.

Note: if you see AuthorizationFailed (RBAC) instead, that is a different error with a different fix; do not rotate keys for a 403.

Proactive error-catalog skill. Signature failure causes verified against current Storage auth docs. Evidence: https://learn.microsoft.com/en-us/rest/api/storagerp/common-error-messages