Every App Store Connect API key on my team returns 401 NOT_AUTHORIZED for every request, since enrollment. I believe the ASC API entitlement was never provisioned for my team server-side, and I can't find any way to verify or fix that myself.
Setup:
- Individual (paid) Apple Developer Program membership, enrolled 2026-08-12.
- Team ID 736ZTRRS22, Issuer ID 20166a52-0258-4dbc-80cd-c1e63d55cd56.
- All agreements Active (Free Apps, Paid Apps, banking, tax). Note: agreement problems surface as 403 REQUIRED_AGREEMENTS_MISSING_OR_EXPIRED, not 401.
What fails — everything, identically:
- GET https://api.appstoreconnect.apple.com/v1/apps → HTTP/2 401 {"errors":[{"status":"401","code":"NOT_AUTHORIZED","title":"Authentication credentials are missing or invalid."}]}
- Three separate TEAM keys (Admin access), created per the documentation: 7293F9VQS5 (active), plus two since revoked. All 401.
- One INDIVIDUAL key (YBQLYQZPDATE) with the documented individual payload ("sub":"user", no "iss") — also 401. Individual keys don't use the Issuer ID, so this rules out a wrong Issuer ID or a corrupt team-key record.
- "Last Used" under Users and Access → Integrations → App Store Connect API has NEVER populated for any key, suggesting my tokens are never resolved to a key record at all.
- The 401s carry no "id" field in the error object and no X-Request-ID header — only x-apple-jingle-correlation-key (values available on support case 20000139980951, along with screenshots).
Control test proving the client side is correct: The identical ES256 signing code, on the same machine and clock, using my APNs key, is ACCEPTED by both api.push.apple.com and api.sandbox.push.apple.com (HTTP/2 400 BadDeviceToken — i.e., authentication succeeded and only my deliberately-invalid test device token was rejected). So key handling, signature format, system clock, and Team ID are all confirmed good. Only the App Store Connect API rejects.
Team-key JWT (per "Generating Tokens for API Requests"): header {"alg":"ES256","kid":"7293F9VQS5","typ":"JWT"} payload {"iss":"20166a52-0258-4dbc-80cd-c1e63d55cd56","iat":<now>, "exp":<now+600>,"aud":"appstoreconnect-v1"} Also reproduced with PyJWT and with fastlane — identical 401.
Developer Support (case 20000139980951) said API troubleshooting is out of scope for them and pointed me here.
Question for Apple engineers: can someone check whether the App Store Connect API entitlement is actually provisioned for team 736ZTRRS22, and whether the key records above are bound to the team? Is there any developer-visible way to see or re-trigger that provisioning? Happy to provide correlation keys / timestamps for specific failing requests.