Objects in Cloud Storage are encrypted with customer-supplied keys entered by customers. Your app receives an HTTP 4xx when reading an object. What is a possible cause?

When using customer-supplied encryption keys (CSEK) with Cloud Storage, you must provide the base64-encoded SHA256 hash of the encryption key in the x-goog-encryption-key-sha256 header for read operations. This hash is used by Cloud Storage to verify that the correct key is being used to decrypt the object. If this hash is missing or incorrect, Cloud Storage will reject the request with an HTTP 4xx error (e.g., 400 Bad Request or 401 Unauthorized) because it cannot validate the key. Attempting the read using the customer's base64-encoded key directly is incorrect because the key itself is not sent in the header for read operations; only its SHA256 hash is. Specifying the same encryption algorithm is not a direct cause of a 4xx error in this context, as the algorithm is implicitly handled by the key. Attempting the read using the base64-encoded SHA256 hash of the customer's key is the correct approach for supplying the hash, so this would not cause an error unless the hash itself was wrong.