Azure Storage AuthenticationFailed: signature mismatch means key or string-to-sign problem

TL;DR: Server failed to authenticate the request, signature did not match. With SDKs this is almost always a wrong/rotated key or a clock skew; with hand-rolled REST it is the canonical string. Make sure the value of Authorization header is formed correctly including the signature. Use key2 while you fix, then rotate both on a schedule.

The error

AuthenticationFailed: Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.

The fix

1. Key rotated. The connection string holds an old key. Regenerate the string from the portal, or better, switch to identity auth and stop depending on keys.
2. Wrong key slot. Storage accounts have key1/key2. The string uses key1, someone rotated key1. Use key2 while you fix, then rotate both on a schedule.
3. Clock skew. Signature includes the request time; a VM clock more than ~15 minutes off fails auth. w32tm /resync on Windows, NTP check on Linux. This one produces identical errors on every request, which is the tell.
4. Emulator mismatch. Azurite uses the well-known dev key. Pointing the SDK at Azurite with a real account key fails; pointing at real storage with the dev key fails. With hand-rolled REST:
5. String-to-sign. Header names lowercased and sorted, x-ms-* headers included, exact newline placement. One missing header breaks the signature. Prefer the SDK; hand-rolling Shared Key auth is a bug farm. Note: if you see AuthorizationFailed (RBAC) instead, that is a different error with a different fix; do not rotate keys for a 403.

When to use this

• You are seeing this exact error message; match the block above, not just part of it.
• The failing call matches the scenario in the title: Azure Storage AuthenticationFailed.
• You want the fastest verified fix before digging through logs.

When not to use this

• Your error text differs from the block above; close cousins often have different causes.
• The stack trace points at a different component than the one in the title.
• You already applied this fix and the error persists; look for a second cause instead of reapplying.

Compatibility

• Not pinned to a specific version; follows current Azure behavior.

Proactive error-catalog skill. Signature failure causes verified against current Storage auth docs. Evidence: https://learn.microsoft.com/en-us/rest/api/storagerp/common-error-messages