We use Apple's official App Store Server Library for Node.js, version 3.1.0.
Our latest Production Get Notification History check, on 24 October 2026 at 15:21 UTC, returned HTTP 401 with an empty response body. The request ran from our deployed backend. We verified the ES256 signature, JWT claims, 300-second token lifetime, Authorization header and system clock alignment.
On 23 October, notification-history requests using the same JWT and server environment returned:
- Sandbox: HTTP 200
- Production: HTTP 401
A separate Production Request a Test Notification also returned 401; no test notification token was issued. The latest check was only a history query, not another TEST request.
The account owner confirmed that the existing In-App Purchase key is Active. Our first app version remains PREPARE_FOR_SUBMISSION and has never been publicly released. Separate Production and Sandbox notification URLs are saved with Version 2 selected.
An Apple App Store Commerce Engineer described a first-production-release prerequisite in this discussion:
https://developer.apple.com/forums/thread/806452
Does that prerequisite apply specifically to both Get Notification History and Request a Test Notification? Neither request uses a transaction ID.
If these endpoints should authenticate before the first release, which additional app-specific authorization prerequisite or non-sensitive diagnostics should we check?
Apple request IDs can be provided privately through an appropriate Apple support channel if requested.