title: How do you generate the signature for an Azure Blob storage SAS token in Python?
body: <p>I am trying to build the SAS token required for a blob download URL in Python, following the instructions from <a href="https://docs.microsoft.com/en-us/rest/api/storageservices/fileservices/Constructing-a-Service-SAS#constructing-the-signature-string" rel="noreferrer">MSDN</a>.</p>
  
  <p>My string to sign looks like:</p>
  
  <pre><code>r\n
  2016-12-22T14%3A00%3A00Z\n
  2016-12-22T15%3A00%3A00Z\n
  %2Fblob%2Fmytest%2Fprivatefiles%2F1%2Fqux.txt\n
  \n
  \n
  https\n
  2015-12-11\n
  \n
  \n
  \n
  \n
  _
  </code></pre>
  
  <p>I've added the newline symbols for clarity and the last line is supposed to be an empty line (with no newline at the end).</p>
  
  <p>The Python method I use for signing the string is:</p>
  
  <pre><code>def sign(self, string):
      hashed = hmac.new(base64.b64decode(self.account_key), digestmod=sha256)
      hashed.update(string)
      base64_str = base64.encodestring(hashed.digest()).strip()
      return base64_str
  </code></pre>
  
  <p>The final URL I build looks like:</p>
  
  <p><a href="https://mytest.blob.core.windows.net/privatefiles/1/qux.txt?sv=2015-12-11&amp;st=2016-12-22T14%3A00%3A00Z&amp;se=2016-12-22T15%3A00%3A00Z&amp;sr=b&amp;sp=r&amp;spr=https&amp;sig=BxkcpoRq3xanEHwU6u5%2FYsULEtOCJebHmupUZaPmBgM%3D" rel="noreferrer">https://mytest.blob.core.windows.net/privatefiles/1/qux.txt?sv=2015-12-11&amp;st=2016-12-22T14%3A00%3A00Z&amp;se=2016-12-22T15%3A00%3A00Z&amp;sr=b&amp;sp=r&amp;spr=https&amp;sig=BxkcpoRq3xanEHwU6u5%2FYsULEtOCJebHmupUZaPmBgM%3D</a></p>
  
  <p>Still, the URL fails with a 403. Any idea on what I am doing wrong?</p>