Every App Store Connect API key on my team returns 401 NOT_AUTHORIZED for every
request, since enrollment. I believe the ASC API entitlement was never provisioned
for my team server-side, and I can't find any way to verify or fix that myself.
Setup:
Individual (paid) Apple Developer Program membership, enrolled 2026-08-12.
Team ID 736ZTRRS22, Issuer ID 20166a52-0258-4dbc-80cd-c1e63d55cd56.
All agreements Active (Free Apps, Paid Apps, banking, tax). Note: agreement
problems surface as 403 REQUIRED_AGREEMENTS_MISSING_OR_EXPIRED, not 401.
What fails — everything, identically:
GET https://api.appstoreconnect.apple.com/v1/apps → HTTP/2 401
{"errors":[{"status":"401","code":"NOT_AUTHORIZED","title":"Authentication
credentials are missing or invalid."}]}
Three separate TEAM keys (Admin access), created per the documentation:
7293F9VQS5 (active), plus two since revoked. All 401.
One INDIVIDUAL key (YBQLYQZPDATE) with the documented individual payload
("sub":"user", no "iss") — also 401. Individual keys don't use the Issuer ID,
so this rules out a wrong Issuer ID or a corrupt team-key record.
"Last Used" under Users and Access → Integrations → App Store Connect API has
NEVER populated for any key, suggesting my tokens are never resolved to a key
record at all.
The 401s carry no "id" field in the error object and no X-Request-ID header —
only x-apple-jingle-correlation-key (values available on support case
20000139980951, along with screenshots).
Control test proving the client side is correct:
The identical ES256 signing code, on the same machine and clock, using my APNs
key, is ACCEPTED by both api.push.apple.com and api.sandbox.push.apple.com
(HTTP/2 400 BadDeviceToken — i.e., authentication succeeded and only my
deliberately-invalid test device token was rejected). So key handling, signature
format, system clock, and Team ID are all confirmed good. Only the App Store
Connect API rejects.
Team-key JWT (per "Generating Tokens for API Requests"):
header {"alg":"ES256","kid":"7293F9VQS5","typ":"JWT"}
payload {"iss":"20166a52-0258-4dbc-80cd-c1e63d55cd56","iat":,
"exp":<now+600>,"aud":"appstoreconnect-v1"}
Also reproduced with PyJWT and with fastlane — identical 401.
Developer Support (case 20000139980951) said API troubleshooting is out of scope
for them and pointed me here.
Question for Apple engineers: can someone check whether the App Store Connect API
entitlement is actually provisioned for team 736ZTRRS22, and whether the key
records above are bound to the team? Is there any developer-visible way to see or
re-trigger that provisioning? Happy to provide correlation keys / timestamps for
specific failing requests.
Topic:
App Store Distribution & Marketing
SubTopic:
App Store Connect API
0
0
71