Using notarytool with app specific password throws 401

Hi,

I want to use notarytool to let my installer *pkg being notarized by apple. The app is a swift desktop app, not supposed to be distributed through the app store. It is already signed and notarized through xcode. Verification done and it has been aproved. So the process should be working.

I'm facing an issue when using notarytool to store cretentials. I followed the steps for described here https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/customizing_the_notarization_workflow

My app specific password I created here: https://appleid.apple.com/account/manage

When I try to strore credentials I get a 401, what did I miss here?

xcrun notarytool store-credentials --verbose
[07:21:52.672Z] Debug [MAIN] Running notarytool version: 1.0.0 (32), date: 2023-12-01T07:21:52Z, command: /Applications/Xcode.app/Contents/Developer/usr/bin/notarytool store-credentials --verbose

This process stores your credentials securely in the Keychain. You reference these credentials later using a profile name.

Profile name:
notarytool-pw
We recommend using App Store Connect API keys for authentication. If you'd like to authenticate with an Apple ID and app-specific password instead, leave this unspecified.

Path to App Store Connect API private key:

Switching prompts to app-specific password credentials.
Developer Apple ID:
<my developer Apple ID>
App-specific password for <my developer Apple ID>:
<the app specific password I created earlier>
Developer Team ID:
<my developer team ID>
Validating your credentials...

[07:31:40.888Z] Info [API] Initialized Notary API with base URL: https://appstoreconnect.apple.com/notary/v2/

[07:31:40.890Z] Info [API] Preparing GET request to URL: https://appstoreconnect.apple.com/notary/v2/test?, Parameters: [:], Custom Headers: private<Dictionary<String, String>>

[07:31:40.890Z] Debug [AUTHENTICATION] Delaying current request to refresh app-specific password token.

[07:31:40.891Z] Info [API] Preparing GET request to URL: https://appstoreconnect.apple.com/notary/v2/asp?, Parameters: [:], Custom Headers: private<Dictionary<String, String>>

[07:31:40.891Z] Debug [AUTHENTICATION] Authenticating request to '/notary/v2/asp' with Basic Auth. Username: <my developer Apple ID>, Password: private<String>, Team ID: <my developer team ID>

[07:31:40.892Z] Debug [TASKMANAGER] Starting Task Manager loop to wait for asynchronous HTTP calls.

[07:31:41.921Z] Debug [API] Received response status code: 401, message: unauthorized, URL: https://appstoreconnect.apple.com/notary/v2/asp?, Correlation Key: 6WYAHNFB6NYEVPPJOT5KJMNPAE

[07:31:41.922Z] Error [TASKMANAGER] Completed Task with ID 2 has encountered an error.

[07:31:41.922Z] Debug [TASKMANAGER] Ending Task Manager loop.
Error: HTTP status code: 401. Unable to authenticate. Invalid session. Ensure that all authentication arguments are correct.

Replies

I can’t see any flaws in your logic here, but the error clearly indicates that the notary service is not happy with those credentials. We can’t really debug account issues here on DevForums because of privacy concerns, so I see two paths forward:

Honestly, I prefer API keys myself, so it might be worth trying that first.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"