How can I generate a valid service SAS token for an Azure blob container without the SDK?

Below is one likely culprit: when you’re building a SAS in access‐policy mode you must set all fields exactly as defined in the documentation. In your code you leave the permissions, start, and expiry strings empty (which is correct) but you’re still setting the optional response header field rsct to "binary". For a SAS that isn’t overriding any response headers you must leave all those (rscc, rscd, rsce, rscl, rsct) as empty strings. Otherwise your computed signature will not match what the storage service expects.

Other things to check include:

• Verify that the string‐to‐sign exactly follows the documented field order and that you are not including an extra trailing newline or misordering fields.
• Make sure you’re correctly decoding the account key from base‑64 before using it to compute the HMAC. A common mistake is to pass the encoded key or to mishandle the raw bytes as a UTF‑8 string.

For example, try updating your code so that none of the response header fields are set (unless you want to override them). For instance:

GOCopied
package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/base64"
    "fmt"
    "net/url"
)

func ComputeHmac256(message string, secret []byte) string {
    h := hmac.New(sha256.New, secret)
    h.Write([]byte(message))
    return base64.StdEncoding.EncodeToString(h.Sum(nil))
}

const accountKey = "xxxxxxx"

var (
    signedPermissions       = "" // Not used when signing via stored access policy
    signedStart             = ""
    signedExpiry            = ""
    canonicalizedResource   = "/blob/storamela/cont1"
    signedIdentifier        = "allperms"
    signedIP                = ""
    signedProtocol          = "https"
    signedVersion           = "2021-08-06"
    signedResource          = "c"
    signedSnapshotTime      = ""
    signedEncryptionScope   = ""
    rscc                    = ""
    rscd                    = ""
    rsce                    = ""
    rscl                    = ""
    rsct                    = "" // leave this empty if no response header override is needed
)

func main() {
    // Construct the string-to-sign as defined for your SAS version
    message := fmt.Sprintf("%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s",
        signedPermissions,
        signedStart,
        signedExpiry,
        canonicalizedResource,
        signedIdentifier,
        signedIP,
        signedProtocol,
        signedVersion,
        signedResource,
        signedSnapshotTime,
        signedEncryptionScope,
        rscc,
        rscd,
        rsce,
        rscl,
        rsct,
    )

    // Decode the base-64 account key into its raw bytes.
    decodedKey, err := base64.StdEncoding.DecodeString(accountKey)
    if err != nil {
        panic(err)
    }

    sig := ComputeHmac256(message, decodedKey)
    escapedSig := url.QueryEscape(sig)
    signedString := fmt.Sprintf("si=%s&spr=%s&sv=%s&sr=%s&sig=%s",
        signedIdentifier, signedProtocol, signedVersion, signedResource, escapedSig,
    )
    fmt.Println(signedString)
}

Here the only change (besides tidying up the secret handling) is that rsct (and any other response header override you aren’t using) is set to an empty string. Double‑check all other fields (including the canonicalized resource – it should be “/blob/youraccount/yourcontainer”) to make sure they exactly match the values used when you configured the stored access policy.

This should help produce a valid signature.