Apple Tightens App Store Authentication, Blocking Third-Party Logins
Apple is gradually tightening App Store authentication, causing third-party clients such as the open-source multi-account tool Asspp to fail login attempts with HTTP 403 errors. The failures occur before credential verification and persist across IP addresses and user agents. Apple is shifting to private access credentials signed by the Secure Enclave in A- and M-series chips, making it impossible for third-party apps to authenticate. Existing credentials remain valid until expiry, but users cannot restore login on their own.
Apple is adjusting its App Store authentication mechanism, currently in a gradual rollout phase. Some third-party clients can no longer log in normally. For example, Asspp, an open-source multi-account management tool, relies on users logging in with their own accounts. Related login requests have begun to consistently return HTTP 403 errors.
The login failure occurs before credential verification. Some users tested both old and new authentication endpoints, switching exit IP addresses and user agents, but still could not log in. Attempts with non-existent accounts also returned identical results. This indicates the failure is not due to account, IP address, or TLS fingerprint issues, but rather to tightened restrictions on Apple's server side.
Reverse engineering of related components shows that App Store credentials are shifting to a private access credential mechanism. The relevant tokens must be generated using the Secure Enclave in A-series and M-series chips, combined with P-384 key signatures, a process controlled jointly by system processes and hardware. Third-party applications cannot complete authentication by forging request parameters or simulating clients.
Credentials that have not yet expired can still be used, but if an account login expires, existing tools will be unable to re-authenticate. These third-party projects rely on Apple's private endpoints rather than public APIs, so users cannot restore normal login through their own actions.