app_store_connect_api_key Authentication credentials are missing or invalid

[NikKovIos]

I'm using next lane:

lane :pilotBuild do
     api_key = app_store_connect_api_key(
        key_id: "MZ******G4",
        issuer_id: "69a6de90-****-****-****-****7c11a4d1",
        key_filepath: "./fastlane/AuthKey_API_MZ5***8KG4.p8",
        duration: 7200, # optional
        in_house: false, # optional but may be required if using match/sigh
      )

     ENV["DELIVER_ITMSTRANSPORTER_ADDITIONAL_UPLOAD_PARAMETERS"] = "-t DAV" # из-за ошибки "all transports failed diagnostics"
     ENV["FASTLANE_APPLE_APPLICATION_SPECIFIC_PASSWORD"] = "gn**-****-****-**tg"
     pilot(
        api_key: api_key,	
        skip_submission: false,
        skip_waiting_for_build_processing: true # поставить false, чтобы устанавливался changelog
     )
end

Output:

[13:18:45]: Driving the lane 'ios pilotBuild' 🚀
[13:18:45]: ---------------------------------------
[13:18:45]: --- Step: app_store_connect_api_key ---
[13:18:45]: ---------------------------------------
[13:18:45]: -------------------
[13:18:45]: --- Step: pilot ---
[13:18:45]: -------------------
[13:18:45]: Creating authorization token for App Store Connect API
[13:18:46]: --------------------------
[13:18:46]: --- Step: notification ---
[13:18:46]: --------------------------
[13:18:47]: Authentication credentials are missing or invalid. - Provide a properly configured and signed bearer token, and make sure that it has not expired. Learn more about Generating Tokens for API Requests https://developer.apple.com/go/?id=api-generating-tokens

Type of the key is

What am i doing wrong?

[aksswami]

Getting the same error with App Manager role key. Last night tried with the Developer role key and worked except changelog can't be provided with developer role.

[anh1979]

When you create that key, you define a role --> for example admin, app manager, developer and so on. There is a dropdown for that.
When you are using the API Key, Apple checks, whether the action you try to fulfil is allowed to be done with the role that is set to the API Key.

Hope I explained it right and it helps.

[aksswami]

I resolved my issue by using the correct issuer id. For some reason, the issuer id changed and I was not updating it in settings. So make sure your key and issuer ids are correct.

[NikKovIos]

@anh1979 i've created admin role key, but still not working(

[dinsen]

@NikKovIos have you tried comment out this line?
ENV["FASTLANE_APPLE_APPLICATION_SPECIFIC_PASSWORD"] = "gnsx-srso-ampo-zmtg"

[NikKovIos]

@dinsen yes(

[ejthayerTN]

Where do I find the issuer_id to begin with? I have not been able to find it.

[dinsen]

You will find it where you create the Auth Key.
Only Account Holder or Admin can see the Keys tab here:
https://appstoreconnect.apple.com/access/api

[Antol]

I have the same issue. But I'm passing API key via json file. All the values are set and the token is being generated (I saw it in /spaceship/connect_api/token.rb file) But I still got the error:
"Authentication credentials are missing or invalid. - Provide a properly configured and signed bearer token, and make sure that it has not expired. Learn more about Generating Tokens for API Requests https://developer.apple.com/go/?id=api-generating-tokens"

[Antol]

Found the reason - duration. Remove it or make it lower. In my case 3591 - was working, 3592 - not

[dinsen]

Duration can be max 1200.

An check for that is made in the latest version of fastlane:
#18346

[NikKovIos]

Lol, my build take 30 minute and auth is only 20 minute. As long as auth happened at the start of gym, that's become a problem (

[NikKovIos]

I resolved the issue by setting correct duration time (Duration can be max 1200)

[khoogheem]

We just ran into this.. issue.. We have been using the same config since Feb.. and just had this pop up in the last two days.. Nothing has changed..

Not working on Sigh or pilot...

api_key = app_store_connect_api_key(
        key_id: "GXXXXXX",
        issuer_id: "69a6de85-xxxxxx-5b8c7c11a4d1",
        key_content: "-----BEGIN PRIVATE KEY-----\nMIqjg1/eUB\nLxxyWE/va\nBWxxxQW3zb\n-----END PRIVATE KEY-----",
        in_house: false
      )

      sigh(
        api_key: api_key,
        adhoc: true,
        force: true
      )

I have tried it with new Admin and App Manager roles with no luck

[khoogheem]

Looks like if I set duration to 500 it ended up working..
setting it to nothing fails now.. setting to 1200 fails....

[Katsz]

Yup

[dbrown15]

Same experience here. Setting the duration explicitly to 500 resolved the issue. Leaving it blank to utilize the default of 1200, and setting it explicitly to 1200 both caused the same failure.

[khawkins]

After a fair amount of troubleshooting—though admittedly not exhaustive (just exhausted 😛)—my best guess is that this has something to do with clock skew between the client and https://api.appstoreconnect.apple.com. Consider the following statement from the Generating Tokens for API Requests docs:

exp - Expiration Time | The token's expiration time, in Unix epoch time; tokens that expire more than 20 minutes in the future are not valid (Ex: 1528408800)

• 1200 is right at the 20-minute limit.
• Where I can reproduce this—in a Docker container—I have around 2-3 seconds of clock skew (for whatever reason) from the container's host, where I can't reproduce it.
• If I set the duration value down to 1199, I get the same error in the container.
• If I set the duration value down to 1150, the error goes away.
• I'm not sure of the actual datetime disparity with https://api.appstoreconnect.apple.com, for that comparison.

My personal feeling is that, in the absence of being able to reliably match the session timeout against a legitimate representation of datetime from Apple, Fastlane should probably err on some lower value of timeout for the default, to pad against reasonable expectations of clock skew between the client and the server.

[DavidBrunow]

Thanks for this write-up of the issue @khawkins! I agree that the default should be lower. I'll put together a pull request to propose that unless it is something you were already in the process of doing.

[khawkins]

@DavidBrunow My hair's on fire enough with other stuff that I did not get around to it, no. 🙂 I'd be much obliged if you had the cycles and wherewithal to put something together.

[DavidBrunow]

Pull request: #19175

[khawkins]

Thanks a lot @DavidBrunow !

[SuperBarracuda]

Amazing thanks

[JB-CHAUVIN]

It was a date issue for me too... My MAC wasn't using the good date.

[DavidBrunow]

#19175 was merged so hopefully future folks won't run into this issue as much.

[Panajev]

Hello @DavidBrunow this has started occurring again, will create a separate Issue and/or Discussion thread.

In short, in our job that takes all our apps and ensures we have for all the app's:

1. appID created and configured capabilities wise (produce, uses FASTLANE_SESSION variable)
2. merchant id associated to the appID (produce again)
3. provisioning profiles created (match, using the api_key, unless we are specifying InHouse/Enterprise ones)
4. APNS push notification SSL certs

What I see, when I execute either locally or on any of the build agents we have, is that after almost exactly 8 minutes (not far off ~500 seconds and always around that time... not 6 minutes, not 1, not 10...) I get the same kind of error as above.

Update: it now seems to work again so it might have been a server side thing from ...

[hermanbanken]

I just wasted a good amount of time due to my key_id being lowercased. Should we make it a bit clearer how people can quickly validate credentials?

Maybe:

• explain the api_key_path option together with sign or any other API-call-making-lane can help to more quickly diagnose
• explain that app_store_connect_api_key does not mean that the API key is actually working (it just reads/writes config)

[airmikec]

### Azure DevOps API Key Issues for deploying to Apple
To get this to successfully work on Azure DevOps Pipeline with an API Key. I ran into so many problems and tried everything I could find and this finally worked. Azure DevOps says you need use the base64 key. Well if you open up the .p8 and copy the base64 encoded string in there, that isn't what they want. They literally want you to copy all of the contenxt in the .p8 file to a base64 string. Don't modify the .p8 file. I found the solution at the follow source, and once you get the data.b64 file open it and copy the base64 string in that file. In the following article is discusses how to do this for Windows, Mac, and Ubuntu.

#21531 (comment)