Authentication error

[cryzet]

What happened?

ipatool.exe auth login -e rxxxxx@gmail.com -p *********** --verbose
4:08PM DBG logging in authCode= email=rxxxxx@gmail.com password=***********
4:08PM DBG error="something went wrong" metadata={"Data":{"Account":{"Address":{"FirstName":"","LastName":""},"Email":""},"CustomerMessage":"","DirectoryServicesID":"","FailureType":"","PasswordToken":""},"Headers":{"Apple-Originating-System":"MZAuth","Apple-Seq":"0.0","Apple-Timing-App":"1 ms","Apple-Tk":"false","B3":"8a0ac85c6b5c0a83af49974a0ac5ce4d-739a24cd9048d9d8","Cache-Control":"private, no-cache, no-store, no-transform, must-revalidate, max-age=0","Content-Length":"0","Date":"Sat, 06 Jun 2026 20:08:39 GMT","Edge-Control":"no-store","G":"t","Server":"Apple","Strict-Transport-Security":"max-age=31536000; includeSubdomains","Vary":"Origin","X-Apple-Jingle-Correlation-Key":"RIFMQXDLLQFIHL2JS5FAVROOJU","X-Apple-Lokamai-No-Cache":"true","X-Apple-Request-Uuid":"8a0ac85c-6b5c-0a83-af49-974a0ac5ce4d","X-B3-Spanid":"739a24cd9048d9d8","X-B3-Traceid":"8a0ac85c6b5c0a83af49974a0ac5ce4d","X-Content-Type-Options":"nosniff","X-Daiquiri-Debug-Worker-Pid":"103926","X-Daiquiri-Instance":"daiquiri:41787001:st53p00it-qujn12040502:7987:26HOTFIX24:daiquiri-amp-commerce-l7services-int-003-st","X-Frame-Options":"SAMEORIGIN","X-Responding-Instance":"MZAuth:20022:::","X-Runtime":"0.001239","X-Xss-Protection":"1; mode=block"},"StatusCode":200}
4:08PM ERR error="something went wrong" success=false

Version

latest

Relevant log output

[void-eth]

same thing happening with me too!
I tried this solution Issue #451 by replacing user agent from old to new but that seems patched by apple recently.

[void-eth]

Intercepting http api calls and retrieving the user agent from latest apple configurator may help, yet I am not sure.
try if you have mac.

[Arbifoxx]

Can verify it's broken. I intercepted the request from an app store login on my iPhone and it seems that the request is quite different. Notably the password seems to now be encrypted rather than plaintext. This must be a new change. Projects like ApplePackageTool are broken as well.

[Arbifoxx]

This legend fixed it: #486

Tysm @ricky0603!!

[void-eth]

@Arbifoxx after applying those changes into my local repo, i got rate limited by Apple.

#486-issuecomment-4642744765

[victor-oliveira1]

I've tested the @Arbifoxx suggested fix and worked
Thanks @Arbifoxx and @ricky0603!!!

[Arbifoxx]

@Arbifoxx after applying those changes into my local repo, i got rate limited by Apple.

#486-issuecomment-4642744765

Weird... I've been testing it in my ApplePackage fork (https://github.com/Arbifoxx/ApplePackage/tree/fix/auth-endpoint) and I haven't hit one. I suppose I didn't test logging in much to be fair, I only had to append "/fast" to the auth endpoint to get signing in working again. I have been slamming the download function though, maybe that doesn't get ratelimited.

[void-eth]

@Arbifoxx my IP was blacklisted, I tried again with VPN and it worked, thank you for the reference.

[cryzet]

I applied the fixes to my local repo and got positive results, but after a while, I could no longer log in, and the same error reappeared. The debug log shows this: 3:17PM DBG error="request failed: failed to unmarshal xml: plist: error parsing text property list: unexpected hex digit h' at line 0 character 2" 3:17PM ERR error="request failed: failed to unmarshal xml: plist: error parsing text property list: unexpected hex digit h' at line 0 character 2" success=false

[cryzet]

It seems Apple is closing the door on us.

[Arbifoxx]

Sadly I have the same issue in my ApplePackageTool fork... I'll look at it later

login failed: Error Domain=NSCocoaErrorDomain Code=3840 "Encountered unknown tag html on line 1" UserInfo={NSDebugDescription=Encountered unknown tag html on line 1, kCFPropertyListOldStyleParsingError=Error Domain=NSCocoaErrorDomain Code=3840 "Malformed data byte group at line 1; invalid hex" UserInfo={NSDebugDescription=Malformed data byte group at line 1; invalid hex}}

[cryzet]

Apple is returning an XML and an HTML (301 Moved Permanently).

[Arbifoxx]

Great... I guess the endpoint changed again. I have an hour, I'm going to look at it now on my ApplePackageTool fork. If I find a solution, I can't integrate it into this project because I don't know go, but at least we'll know the endpoint.

EDIT, sure enough...

swift run ApplePackageTool login $email $password
Building for debugging...
[7/7] Applying ApplePackageTool
Build of product 'ApplePackageTool' complete! (2.25s)
2026-06-09T09:07:37-0400 info com.applepackage: [ApplePackage] bag: auth endpoint resolved to https://auth.itunes.apple.com/auth/v1/native/fast
2026-06-09 09:07:38.108 ApplePackageTool[62409:443359] <html>
<head><title>301 Moved Permanently</title></head>
<body>
<center><h1>301 Moved Permanently</h1></center>
<hr><center>Apple</center>
</body>
</html>

Cmon, Apple! Stop making out lives harder!

EDIT:

It's so weird... I intercepted the login request that comes from the iOS 15 App Store on an iPhone 7 I had lying around, and it uses the non-fast endpoint: https://auth.itunes.apple.com/auth/v1/native... Weird...

POST /auth/v1/native HTTP/1.1
Host: auth.itunes.apple.com
Cookie: (redacted)
iCloud-DSID: (redacted)
User-Agent: AppStore/3.0 iOS/14.2 model/iPhone9,3 hwp/t8010 build/18B92 (6; dt:139)
X-Apple-Store-Front: (redacted)
X-DSID: (redacted)
X-Apple-Tz: (redacted)
X-Apple-Client-Application: com.apple.accountsd
Content-Length: 1173
X-Apple-I-TimeZone: EDT
X-Apple-AMD-M: (redacted)
X-Apple-I-Client-Time: 2026-06-09T13:31:38Z
X-Apple-AMD:(redacted)
Connection: keep-alive
Accept-Language: en-US
X-Apple-I-MD-RINFO: (redacted)
X-Apple-ADSID: (redacted)
X-Apple-ActionSignature: (redacted)
Accept: */*
Content-Type: application/x-apple-plist
Accept-Encoding: br, gzip, deflate
X-Apple-I-Locale: en_US
X-Apple-I-MD-M:(redacted)
X-Apple-I-MD: (redacted)

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>appleId</key>
	<string>(redacted, my plain text email)</string>
	<key>createSession</key>
	<true/>
	<key>credentialSource</key>
	<integer>0</integer>
	<key>guid</key>
	<string>(redacted)</string>
	<key>isSilentAuthentication</key>
	<false/>
	<key>password</key>
	<string>(redacted, but it's not my plain text password. It's encrypted with some algo)</string>
	<key>passwordSettings</key>
	<dict>
		<key>free</key>
		<string>always</string>
		<key>paid</key>
		<string>sometimes</string>
	</dict>
	<key>rmp</key>
	<string>0</string>
</dict>
</plist>

[Arbifoxx]

Almost fixed it, I got an icloud code now but something is still preventing a login

This is the error it fails with after I use the code:

<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<plist version="1.0">
<dict>
<key>pings</key>
<array></array>
<key>failureType</key><string></string>
<key>customerMessage</key><string>AMD-Action::SP</string>
<key>m-allowed</key><false/>
</dict>
</plist>