`auth login` succeeds but `download` immediately fails with `password token is expired`

[yanashenyang]

What happened?

auth login succeeds but download immediately fails with password token is expired

Environment

• OS: macOS
• ipatool: locally built from recent auth-fix PR branches
• Tested PR branches:
  • fix: update auth endpoint + stale lock file cleanup #486
  • Fix App Store auth endpoint handling #490
  • Fix dynamic App Store auth endpoint discovery #493
  • Fix App Store auth #494

Summary

After Apple's recent App Store auth changes, I tested several auth-fix PR branches. Some branches can make auth login succeed, but download immediately fails with:

error="password token is expired"

This happens immediately after a clean login, even after removing local cookies.

Reproduction

rm -f ~/.ipatool/cookies ~/.ipatool/cookies.lock

ipatool auth revoke
ipatool auth login -e "<APPLE_ID>" -p "<PASSWORD>" --verbose

ipatool download --app-id 951937596 --non-interactive --verbose

Observed Result

auth login reports success:

INF email=<redacted> name="<redacted>" success=true

But download immediately fails:

DBG error="password token is expired"
ERR error="password token is expired" success=false

Additional Tests

I also tested splitting the flow into purchase then download:

ipatool purchase -b com.microsoft.Office.Outlook --non-interactive --verbose
ipatool download --app-id 951937596 --non-interactive --verbose

The script reaches the download step, but download still fails with:

error="password token is expired"

I also tried clearing cookies before each login:

rm -f ~/.ipatool/cookies ~/.ipatool/cookies.lock

No change.

Branch-Specific Observations

• Older/main released version:

  • auth login fails with something went wrong
  • response has StatusCode: 200 but empty PasswordToken

• Fix App Store auth endpoint handling #490 / Fix dynamic App Store auth endpoint discovery #493:

  • auth login succeeds
  • download immediately fails with password token is expired

• fix: update auth endpoint + stale lock file cleanup #486:

  • Similar behavior: login can succeed, download fails with expired password token

• Fix App Store auth #494:

  • It enters a 2FA flow:

    INF enter 2FA code:
    DBG error="auth code is required"
    ERR error="auth code is required"
    

  • However, no 2FA prompt/code is received on my Apple devices during this CLI flow.

  • Web login at account.apple.com triggers 2FA normally.

Expected Result

After auth login succeeds, download should be able to use the issued token and download the IPA, or the login command should fail if the returned token is not valid for downloads/purchase.

Questions

Is the token returned by the new auth endpoint only valid for login/account info but not for App Store download/purchase?

Is there an additional step needed after auth login to obtain a commerce-grade token usable by download / purchase?

Version

release 2.3.0

Relevant log output

[koraytutuncu]

PR #483 fixes the licensed app download issue.

You may need to make a few adjustments when merging it into your current codebase to preserve both fixes.

I'll update the PR once a stable auth fix is merged into main.