Hi Lenz, Philipp
Thanks for outlining the troubleshooting you have already done, that rules out most of the common causes. The 40103: Invalid authorization token signature usually comes down to either the string-to-sign mismatch or the audience (sr) field in the SAS token not aligning exactly with what Event Hubs expects. A couple of things to double-check:

Resource URI in SAS token

• For an Event Hub, the resource string in the SAS token must be lowercase and must exactly match the path:

    https://<namespace>.servicebus.windows.net/<eventhub-name> 
  

  In your case:

    https://streaming.servicebus.windows.net/stream1 
  

• If you’re signing at the namespace level, omit the event hub name:

    https://streaming.servicebus.windows.net/
  

Token construction

• Ensure the SAS signature is built as:

    StringToSign = <URL-encoded resourceURI> + "\n" + expiry 
    signature = Base64(HMAC-SHA256(UTF8(StringToSign), <SAS key>)) 
  

• Double check that the expiry is in UNIX epoch seconds and that the system clock on the sender machine matches UTC closely.

LocalAuth flag

• Since disableLocalAuth = false, SAS auth is valid. If you ever move to AAD, the same error would appear if the JWT audience was incorrect - but here it’s SAS-specific.

Reference: Generate and use SAS tokens with Event Hubs

I hope this information helps. Please do let us know if you have any further queries.

Kindly consider upvoting the comment if the information provided is helpful. This can assist other community members in resolving similar issues.

Hi Smaran,

Thank you for your quick response. I have implemented this so far in my PowerShell script. Unfortunately, I am still getting the same error.

Error while sending: The remote server returned an error: (401) Unauthorized. HTTP Status: 401

Do you see anything in the script that I might have done wrong?

$namespace = "streaming"

$eventHub = "stream1"

$sasKeyName = "xxx" # Shared access key name

$sasKey = "42RiSxnqSNE6eFyMP+gmyhUHAXO+5vBC3+AEhDNv4q4=" # Primary key

$resourceUri = "https://$namespace.servicebus.windows.net/$eventHub"

Sample payload (adjust as needed)

$payloadObj = @{

time = (Get-Date).ToString("o")

msg = "Hello Event Hub"

value = 123

}

$payloadJson = $payloadObj | ConvertTo-Json -Depth 10

--- Helper functions ---

function UrlEncode([string]$s) {

RFC 3986 compliant encoding (no '+' for spaces)

return [System.Uri]::EscapeDataString($s)

}

function New-SasToken([string]$uri, [string]$keyName, [string]$key, [int]$ttlSeconds = 3600) {

Expiry time (Unix epoch in seconds)

$expiry = [int][double]::Parse((Get-Date -Date (Get-Date).ToUniversalTime().AddSeconds($ttlSeconds) -UFormat %s))

StringToSign = <URL-encoded resourceURI> + "\n" + expiry

$encodedUri = UrlEncode($uri.ToLowerInvariant())

$stringToSign = "$encodedUri`n$expiry"

signature = Base64(HMAC-SHA256(UTF8(StringToSign), <SAS key>))

$hmac = New-Object System.Security.Cryptography.HMACSHA256

$hmac.Key = [Convert]::FromBase64String($key)

$sigBytes = $hmac.ComputeHash([Text.Encoding]::UTF8.GetBytes($stringToSign))

$signature = [Convert]::ToBase64String($sigBytes)

$sigEnc = UrlEncode($signature)

Token format:

SharedAccessSignature sr=<encodedUri>&sig=<sigEnc>&se=<expiry>&skn=<keyName>

$token = "SharedAccessSignature sr=$encodedUri&sig=$sigEnc&se=$expiry&skn=$keyName"

return $token

}

--- Build token ---

$sasToken = New-SasToken -uri $resourceUri -keyName $sasKeyName -key $sasKey -ttlSeconds 3600

--- REST call to Event Hub ---

Event Hubs REST endpoint (messages)

$endpoint = "https://$namespace.servicebus.windows.net/$eventHub/messages?timeout=60&api-version=2014-01"

Optional: BrokerProperties (e.g. PartitionKey) – omitted here. If needed:

$headers = @{

"Authorization" = $sasToken

"Content-Type" = "application/json"

"BrokerProperties" = '{"PartitionKey":"my-partition-key"}'

}

$headers = @{

"Authorization" = $sasToken

"Content-Type" = "application/json"

}

try {

$resp = Invoke-RestMethod -Uri $endpoint -Method Post -Headers $headers -Body $payloadJson

Write-Host "Sent. HTTP 201 (Created) is not thrown as an error." -ForegroundColor Green

} catch {

Write-Host "Error while sending: $($_.Exception.Message)" -ForegroundColor Red

if ($.Exception.Response -and $.Exception.Response.StatusCode) {

Write-Host ("HTTP status: {0}" -f [int]$_.Exception.Response.StatusCode) -ForegroundColor Yellow

}

}

Write-Host "`n SAS Token (truncated):" -ForegroundColor Cyan

Write-Host ($sasToken.Substring(0, [Math]::Min(120, $sasToken.Length)) + "...")

Hi Smaran,

Thank you for your quick response. I have implemented this so far in my PowerShell script. Unfortunately, I am still getting the same error.

Error while sending: The remote server returned an error: (401) Unauthorized. HTTP Status: 401

Do you see anything in the script that I might have done wrong?
$namespace = "streaming"

$eventHub = "stream1"

$sasKeyName = "xxx" # Shared access key name

$sasKey = "42RiSxnqSNE6eFyMP+gmyhUHAXO+5vBC3+AEhDNv4q4=" # Primary key

$resourceUri = "https://$namespace.servicebus.windows.net/$eventHub"

Sample payload (adjust as needed)

$payloadObj = @{

time = (Get-Date).ToString("o")

msg = "Hello Event Hub"

value = 123

}

$payloadJson = $payloadObj | ConvertTo-Json -Depth 10

--- Helper functions ---

function UrlEncode([string]$s) {

RFC 3986 compliant encoding (no '+' for spaces)

return [System.Uri]::EscapeDataString($s)

}

function New-SasToken([string]$uri, [string]$keyName, [string]$key, [int]$ttlSeconds = 3600) {

Expiry time (Unix epoch in seconds)

$expiry = [int][double]::Parse((Get-Date -Date (Get-Date).ToUniversalTime().AddSeconds($ttlSeconds) -UFormat %s))

StringToSign = <URL-encoded resourceURI> + "\n" + expiry

$encodedUri = UrlEncode($uri.ToLowerInvariant())

$stringToSign = "$encodedUri`n$expiry"

signature = Base64(HMAC-SHA256(UTF8(StringToSign), <SAS key>))

$hmac = New-Object System.Security.Cryptography.HMACSHA256

$hmac.Key = [Convert]::FromBase64String($key)

$sigBytes = $hmac.ComputeHash([Text.Encoding]::UTF8.GetBytes($stringToSign))

$signature = [Convert]::ToBase64String($sigBytes)

$sigEnc = UrlEncode($signature)

Token format:

SharedAccessSignature sr=<encodedUri>&sig=<sigEnc>&se=<expiry>&skn=<keyName>

$token = "SharedAccessSignature sr=$encodedUri&sig=$sigEnc&se=$expiry&skn=$keyName"

return $token

}

--- Build token ---

$sasToken = New-SasToken -uri $resourceUri -keyName $sasKeyName -key $sasKey -ttlSeconds 3600

--- REST call to Event Hub ---

Event Hubs REST endpoint (messages)

$endpoint = "https://$namespace.servicebus.windows.net/$eventHub/messages?timeout=60&api-version=2014-01"

Optional: BrokerProperties (e.g. PartitionKey) – omitted here. If needed:

$headers = @{

"Authorization" = $sasToken

"Content-Type" = "application/json"

"BrokerProperties" = '{"PartitionKey":"my-partition-key"}'

}

$headers = @{

"Authorization" = $sasToken

"Content-Type" = "application/json"

}

try {

$resp = Invoke-RestMethod -Uri $endpoint -Method Post -Headers $headers -Body $payloadJson

Write-Host "Sent. HTTP 201 (Created) is not thrown as an error." -ForegroundColor Green

} catch {

Write-Host "Error while sending: $($_.Exception.Message)" -ForegroundColor Red

if ($.Exception.Response -and $.Exception.Response.StatusCode) {

Write-Host ("HTTP status: {0}" -f [int]$_.Exception.Response.StatusCode) -ForegroundColor Yellow

}

}

Write-Host "`n SAS Token (truncated):" -ForegroundColor Cyan

Write-Host ($sasToken.Substring(0, [Math]::Min(120, $sasToken.Length)) + "...")

Lenz, Philipp I kindly request you to provide the details mentioned in the private message so we can identify the root cause and address the issue effectively.