Context

When configuring iOS App Store code signing in a codemagic.yaml workflow, you may encounter the following error:

POST https://api.appstoreconnect.apple.com/v1/certificates returned 401: Authentication credentials are missing or invalid. - Provide a properly configured and signed bearer token, and make sure that it has not expired.

This error occurs when Codemagic attempts to communicate with the App Store Connect API using your credentials, but the API rejects the request due to missing, incorrect, or malformed authentication details.

Answer

A 401 error from the App Store Connect API typically means that one or more of your API credentials are incorrect, expired, or improperly formatted. Follow the steps below to diagnose and resolve the issue:

1. Verify all three required environment variables are correctly set:

   • APP_STORE_CONNECT_ISSUER_ID — Should be a valid UUID (36 characters).

   • APP_STORE_CONNECT_KEY_IDENTIFIER — Should be a 10-character key ID.

   • APP_STORE_CONNECT_PRIVATE_KEY — Should be the full contents of your .p8 file.

2. Check the format of APP_STORE_CONNECT_PRIVATE_KEY: Make sure the private key includes the full delimiters and has no extra spaces or line breaks:

   -----BEGIN PRIVATE KEY-----
   …your key…
   -----END PRIVATE KEY-----

3. Confirm your App Store Connect API key has the required permissions: The API key must have Admin or App Manager access in order to fetch certificates and provisioning profiles. You can verify this in App Store Connect → Users and Access → Keys.

4. Regenerate the API key if needed: If you suspect the key may be expired or compromised, generate a new API key in App Store Connect, download the fresh .p8 file, and update your Codemagic environment variables accordingly. Make sure the Key ID and Issuer ID you enter in Codemagic match exactly what is shown in App Store Connect.

5. Re-check your environment variable group configuration: Ensure the environment group containing your App Store Connect credentials is correctly referenced in your codemagic.yaml workflow under the environment section, for example:

   environment:
     groups:
       - app_store_credentials

After verifying and correcting the above, trigger a new build to confirm the 401 error is resolved.