diff --git a/R/sas.R b/R/sas.R
index b05b14c..3c8eb9e 100644
--- a/R/sas.R
+++ b/R/sas.R
@@ -47,20 +47,23 @@
 #' [Create a service SAS](https://learn.microsoft.com/en-us/rest/api/storageservices/create-service-sas)
 #'
 #' @examples
+#' # Azure account keys are base64-encoded; use a dummy key for these examples.
+#' key <- openssl::base64_encode(charToRaw("example-key"))
+#'
 #' # account SAS valid for 7 days
-#' get_account_sas("mystorage", "access_key", start=Sys.Date(), expiry=Sys.Date() + 7)
+#' get_account_sas("mystorage", key, start=Sys.Date(), expiry=Sys.Date() + 7)
 #'
 #' # SAS with read/write/create/delete permissions
-#' get_account_sas("mystorage", "access_key", permissions="rwcd")
+#' get_account_sas("mystorage", key, permissions="rwcd")
 #'
 #' # SAS limited to blob (+ADLS2) and file storage
-#' get_account_sas("mystorage", "access_key", services="bf")
+#' get_account_sas("mystorage", key, services="bf")
 #'
 #' # SAS for file storage, allows access to files only (not shares)
-#' get_account_sas("mystorage", "access_key", services="f", resource_types="o")
+#' get_account_sas("mystorage", key, services="f", resource_types="o")
 #'
 #' # getting the key from an endpoint object
-#' endp <- storage_endpoint("https://mystorage.blob.core.windows.net", key="access_key")
+#' endp <- storage_endpoint("https://mystorage.blob.core.windows.net", key=key)
 #' get_account_sas(endp, permissions="rwcd")
 #'
 #' # service SAS for a container
diff --git a/man/sas.Rd b/man/sas.Rd
index f1eb9b2..c5230bf 100644
--- a/man/sas.Rd
+++ b/man/sas.Rd
@@ -131,20 +131,23 @@ To invalidate all user delegation keys, as well as the SAS's generated with them
 See the examples and Microsoft Docs pages below for how to specify arguments like the services, permissions, and resource types. Also, while not explicitly mentioned in the documentation, ADLSgen2 storage can use any SAS that is valid for blob storage.
 }
 \examples{
+# Azure account keys are base64-encoded; use a dummy key for these examples.
+key <- openssl::base64_encode(charToRaw("example-key"))
+
 # account SAS valid for 7 days
-get_account_sas("mystorage", "access_key", start=Sys.Date(), expiry=Sys.Date() + 7)
+get_account_sas("mystorage", key, start=Sys.Date(), expiry=Sys.Date() + 7)
 
 # SAS with read/write/create/delete permissions
-get_account_sas("mystorage", "access_key", permissions="rwcd")
+get_account_sas("mystorage", key, permissions="rwcd")
 
 # SAS limited to blob (+ADLS2) and file storage
-get_account_sas("mystorage", "access_key", services="bf")
+get_account_sas("mystorage", key, services="bf")
 
 # SAS for file storage, allows access to files only (not shares)
-get_account_sas("mystorage", "access_key", services="f", resource_types="o")
+get_account_sas("mystorage", key, services="f", resource_types="o")
 
 # getting the key from an endpoint object
-endp <- storage_endpoint("https://mystorage.blob.core.windows.net", key="access_key")
+endp <- storage_endpoint("https://mystorage.blob.core.windows.net", key=key)
 get_account_sas(endp, permissions="rwcd")
 
 # service SAS for a container
diff --git a/tests/testthat/test10b_sas_example.R b/tests/testthat/test10b_sas_example.R
new file mode 100644
index 0000000..d8ff6b9
--- /dev/null
+++ b/tests/testthat/test10b_sas_example.R
@@ -0,0 +1,12 @@
+test_that("account SAS examples use a valid base64-encoded key", {
+    key <- openssl::base64_encode(charToRaw("example-key"))
+    start <- Sys.Date()
+    expiry <- start + 7
+
+    direct_sas <- get_account_sas("mystorage", key, start=start, expiry=expiry)
+    endp <- storage_endpoint("https://mystorage.blob.core.windows.net", key=key)
+    endpoint_sas <- get_account_sas(endp, start=start, expiry=expiry)
+
+    expect_match(direct_sas, "sig=")
+    expect_match(endpoint_sas, "sig=")
+})