I am using curl command to POST request to app store sandbox server by passing jwt token in the request header. Below is the code to generate signed token
var jwt = require("jsonwebtoken");
var fs = require("fs");
var currentDate = Math.floor(new Date().getTime() / 1000);
var expiryDate = currentDate + 2 * 60 * 60;
var header = {
typ: "JWT",
alg: "ES256",
kid: "key_id",
};
var payload = {
iss: "issue_id",
aud: "appstoreconnect-v1",
iat: currentDate,
exp: expiryDate,
bid: "bundle_id",
};
var privateKey = fs.readFileSync("privateKey");
var token = jwt.sign(payload, privateKey, {
algorithm: "ES256",
header,
});
console.log(token)
The curl command:
curl -v -H 'Authorization: Bearer token' -X POST https://api.storekit-sandbox.itunes.apple.com/inApps/v1/notifications/test
Is there something i am missing while calling the api or generating the token?
The error says:
* Trying 17.36.202.9:443...
* Connected to api.storekit-sandbox.itunes.apple.com (17.36.202.9) port 443 (#0)
* ALPN: offers h2
* ALPN: offers http/1.1
* CAfile: /etc/ssl/cert.pem
* CApath: none
* (304) (OUT), TLS handshake, Client hello (1):
* (304) (IN), TLS handshake, Server hello (2):
* (304) (IN), TLS handshake, Unknown (8):
* (304) (IN), TLS handshake, Certificate (11):
* (304) (IN), TLS handshake, CERT verify (15):
* (304) (IN), TLS handshake, Finished (20):
* (304) (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / AEAD-AES256-GCM-SHA384
* ALPN: server accepted h2
* Server certificate:
* subject: businessCategory=Private Organization; jurisdictionCountryName=US; jurisdictionStateOrProvinceName=California; serialNumber=C0806592; C=US; ST=California; L=Cupertino; O=Apple Inc.; OU=management:idms.group.506364; CN=commercegateway.itunes.apple.com
* start date: Apr 21 12:32:45 2022 GMT
* expire date: May 21 12:32:44 2023 GMT
* subjectAltName: host "api.storekit-sandbox.itunes.apple.com" matched cert's "api.storekit-sandbox.itunes.apple.com"
* issuer: C=US; O=Apple Inc.; CN=Apple Public EV Server RSA CA 2 - G1
* SSL certificate verify ok.
* Using HTTP2, server supports multiplexing
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* h2h3 [:method: POST]
* h2h3 [:path: /inApps/v1/notifications/test]
* h2h3 [:scheme: https]
* h2h3 [:authority: api.storekit-sandbox.itunes.apple.com]
* h2h3 [user-agent: curl/7.84.0]
* h2h3 [accept: */*]
* h2h3 [authorization: Bearer token]
* Using Stream ID: 1 (easy handle 0x14c811400)
> POST /inApps/v1/notifications/test HTTP/2
> Host: api.storekit-sandbox.itunes.apple.com
> user-agent: curl/7.84.0
> accept: */*
> authorization: Bearer token
>
* Connection state changed (MAX_CONCURRENT_STREAMS == 1024)!
< HTTP/2 401
< server: daiquiri/3.0.0
< date: Mon, 14 Nov 2022 06:52:35 GMT
< content-type: text/plain
< strict-transport-security: max-age=31536000; includeSubDomains
< x-apple-jingle-correlation-key: C7PN6UNB3HI5KT2CQYAKAIGWHQ
< x-daiquiri-instance: daiquiri:47578001:st44p00it-hyhk15014801:7987:22HOTFIX10:daiquiri-amp-commerce-clients-ext-002-st
<
Unauthenticated
Request ID: C7PN6UNB3HI5KT2CQYAKAIGWHQ.0.0
* Connection #0 to host api.storekit-sandbox.itunes.apple.com left intact
Someone please help me out to resolve this issue
Thank you for reaching out. From https://developer.apple.com/documentation/appstoreserverapi/generating_tokens_for_api_requests:
exp - Expiration Time The token's expiration time, in UNIX time. Tokens that expire more than 60 minutes after the time in iat are not valid (Ex: 1623086400)
It appears your token has an expiration time that is 2 hours in the future, please try reducing this to 1 hour and trying again.
Edit: Also, please make sure in your curl request you are actually pass the token not the word token or similar, I reviewed server logs and your token seemed to be malformed in some way, like it didn't contain any periods (the JWT delimiter).
