title: Event Hub API POST: 40103: Invalid authorization token signature
body: <p>Before this gets marked as a duplicate: I have read every question/answer on SO with the above error message, and none of them solved my problem. I must be missing something simple, as what should be simple is not working.</p>
  
  <p>I have created an Event Hub Namespace, with a "Send" Shared Access Policy and an Event Hub in the namespace.</p>
  
  <p>Using the code from the <a href="https://github.com/Azure/azure-event-hubs-python/blob/master/azure/eventhub/client.py#L55" rel="nofollow noreferrer">Python Event Hub SDK</a> (which was <a href="https://stackoverflow.com/a/44273541">suggested in another answer</a>), I have the following script to create my <code>Authorization</code> header:</p>
  
  <pre class="lang-py prettyprint-override"><code>import time
  from base64 import b64encode, b64decode
  from hashlib import sha256
  from hmac import HMAC
  from urllib.parse import quote_plus, urlencode
  
  def generate_sas_token(uri, policy, policy_key, expiry_days=14):
      expiry = time.time() + expiry_days * 60 * 60 * 24
      encoded_uri = quote_plus(uri)
      ttl = int(expiry)
      sign_key = '{}\n{}'.format(encoded_uri, ttl)
      signature = b64encode(HMAC(b64decode(policy_key), sign_key.encode('utf-8'), sha256).digest())
      result = {
          'sr': uri,
          'sig': signature,
          'se': str(ttl),
          'skn': policy
      }
      return 'SharedAccessSignature ' + urlencode(result)
  
  if __name__ == '__main__':
      NAMESPACE = input('Namespace: ').strip().lower()
      URI = '{}.servicebus.windows.net'.format(NAMESPACE)
      POLICY = input('Policy: ').strip()
      POLICY_KEY = input('Policy key: ').strip()
      EXPIRY_DAYS = int(input('Expiry (days): ').strip())
      print(generate_sas_token(URI, POLICY, POLICY_KEY, EXPIRY_DAYS))
  </code></pre>
  
  <p>Now, if I run this script using the following (dummy) values:</p>
  
  <pre><code>NAMESPACE=&lt;my Event Hub Namespace&gt; # let's call it "ehns"
  POLICY=&lt;"Send" Shared Access Policy Name&gt; # let's call it "event-publisher"
  POLICY_KEY=&lt;Primary Key for the above policy, ends with = sign&gt;
  EXPIRY_DAYS=14
  </code></pre>
  
  <p>then I get the following (dummy) <code>Authorization</code> header:</p>
  
  <pre><code>SharedAccessSignature sr=ehns.servicebus.windows.net&amp;sig=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx%3D&amp;se=1574773874&amp;skn=event-publisher
  </code></pre>
  
  <p>Now when I POST a dummy message to the API endpoint, <a href="https://docs.microsoft.com/en-us/rest/api/eventhub/send-event" rel="nofollow noreferrer">following this page</a>:</p>
  
  <pre class="lang-sh prettyprint-override"><code>curl -i -X POST --data-ascii "test message" -H "Content-Type: text/plain" -H "Authorization: SharedAccessSignature sr=ehns.servicebus.windows.net&amp;sig=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx%3D&amp;se=1574773874&amp;skn=event-publisher" https://ehns.servicebus.windows.net/ehresource/messages
  </code></pre>
  
  <p>I get the following response:</p>
  
  <pre><code>HTTP/1.1 401 SubCode=40103: Invalid authorization token signature
  Content-Length: 0
  Server: Microsoft-HTTPAPI/2.0
  Strict-Transport-Security: max-age=31536000
  Date: Tue, 12 Nov 2019 13:11:34 GMT
  </code></pre>
  
  <p>Notes:</p>
  
  <ul>
  <li>I have also tried generating the Shared Access Signature with the shell commands on <a href="https://community.cloudera.com/t5/Community-Articles/Creating-Shared-Access-Signature-SAS-token-for-Azure-Event/ta-p/248244" rel="nofollow noreferrer">this page</a>, linked to by one of the questions/answers, to no avail.</li>
  <li>I have also tried the <a href="https://github.com/sandrinodimattia/RedDog/releases/tag/0.2.0.1" rel="nofollow noreferrer">Event Hubs Signature Generator</a>, with no more success.</li>
  </ul>