SAS Token in fabric-Not Working

I was having this same issue for a few days trying to figure out what the problem is. I finally got it to work in Python with the following code:

# Requires 'pip install azure-storage-file-datalake azure-identity'
from azure.storage.filedatalake import (
    DataLakeServiceClient,
    generate_directory_sas,
)
from azure.identity import DefaultAzureCredential
from datetime import datetime, timedelta
import pytz


def get_user_delegation_sas(workspace: str, data_path: str) -> str:
    """
    Generates a User Delegation SAS token for accessing a Data Lake in Azure.
    """
    token_credential = DefaultAzureCredential()
    service_client = DataLakeServiceClient(
        account_url="https://onelake.dfs.fabric.microsoft.com",
        credential=token_credential
    )

    # Get a user delegation key that's valid for 30 minutes
    delegation_key_start_time = (datetime.now(pytz.utc) - timedelta(minutes=5)).replace(second=0, microsecond=0)
    delegation_key_expiry_time = delegation_key_start_time + timedelta(minutes=30)
    user_delegation_key = service_client.get_user_delegation_key(
        key_start_time=delegation_key_start_time,
        key_expiry_time=delegation_key_expiry_time,
    )

    return generate_directory_sas(
        account_name="onelake",
        file_system_name=workspace,
        directory_name=data_path,
        credential=user_delegation_key,
        permission="racwdl",
        expiry=delegation_key_expiry_time,
        start=delegation_key_start_time,
    )


if __name__ == "__main__":
    ACCOUNT_URL = "https://onelake.dfs.fabric.microsoft.com"
    WORKSPACE_NAME = "<workspace name>"
    LAKEHOUSE_NAME = "<Lakehouse name>"
    root_path = f"{LAKEHOUSE_NAME}.Lakehouse"
    data_path = f"{root_path}/Files"

    # SAS token has permission on lakehouse root path, could be more specific
    sas_token = get_user_delegation_sas(WORKSPACE_NAME, root_path)
    print("SAS token: ", sas_token)

    # Try to use sas token to list files
    service_client = DataLakeServiceClient(ACCOUNT_URL, credential=sas_token)
    file_system_client = service_client.get_file_system_client(WORKSPACE_NAME)
    paths = file_system_client.get_paths(path=data_path, recursive=True)
    for path in paths:
        print(path.name + "\n")

My main issue was that I used the endpoint in the generation and signing of the SAS token, but the right answer is to use "onelake" only. I have also been trying to use lakehouse and workspace Item IDs, but I only got it to work with names.