Support alternative 2FA methods (Physical FIDO2)

[daneov]

Is your feature request related to a problem? Please describe.
When trying to authenticate, the --verbose flag shows my FIDO devices are registered, but it doesn't allow me to log in.

Describe the solution you'd like
To be prompted to use my YubiKey and authenticate through it.

Describe alternatives you've considered
Remove my YubiKey's to log in, but decided against.

Additional context

{
  "cancelled" : false,
  "accountName" : "<apple_id>",
  "keyNames" : [ "FIDO2 - Key 1", "FIDO2 - Key 2" ],
  "requirePrf" : false,
  "passkeyAutofill" : false,
  "fsaChallenge" : {
    "challenge" : "some_challenge",
    "keyHandles" : [ "key_handle1 "key_handle2" ],
    "rpId" : "apple.com",
    "allowedCredentials" : "key_handle1,key_handle2"
  }
}

[sebsto]

Thank you Daneov for your feedback.

I never tried to authenticate on Apple's developer portal with a FIDO key.
Is it working when

• you connect from a browsers to developer.apple.com ?
• you use fastlane ?

Can you try again using --versbose option and share here the result of the log ?

[daneov]

Hey @sebsto, thanks for the quick response!

• Yes, developer.apple.com asks for the FIDO key and uses it as a 2nd factor.

• I do not use fastlane at this time. I came across xcodeinstall while working with a VM and wanting to install Xcode through the cli. I installed it on the host laptop trying to xcodeinstall authenticate, but it fails with:

  🔐 Two factors authentication is enabled but no verification methods are available.
  Please ensure you have trusted devices or phone numbers configured:
  https://support.apple.com/en-us/HT204915
  

The --verbose flag prints a quite a lot, something specific you're looking for? I redacted some stuff related to location and some headers, because I wasn't entirely sure what's secret and what is not. I assume location is non-relevant, and that you're mostly interested in the response of the API? I don't have sufficient insight into the API to know how to build it myself, but if I can help test then I am happy to do.

verbose logs

- - - - - - - - - - INCOMING - - - - - - - - - -

2026-05-18T15:37:58+0200 debug xcodeinstall: [xcodeinstall] https://idmsa.apple.com/appleauth/auth/signin/complete?isRememberMeEnabled=false

HTTP 409 /appleauth/auth/signin/complete?isRememberMeEnabled=false
Host: idmsa.apple.com
Location: /auth
X-Apple-HC-Bits: 11
X-Apple-ID-Session-Id: <redacted_session_id>
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Language: en-US
X-Apple-TwoSV-Trust-Eligible: true
Set-Cookie: dslang=US-EN; Domain=apple.com; Path=/; Secure; HttpOnly, site=US; Domain=apple.com; Path=/; Secure; HttpOnly
Date: Mon, 18 May 2026 13:37:57 GMT
X-Apple-ID-Account-Country: US
Content-Encoding: gzip
Vary: accept-encoding
X-Apple-Auth-Attributes: <redacted_attributes>
X-XSS-Protection: 1; mode=block
Transfer-Encoding: Identity
X-Apple-HC-Challenge: <redacted_challenge>
X-Content-Type-Options: nosniff
Cache-Control: no-store, no-store
X-Apple-I-Request-ID: <redacted_request_id>
Connection: keep-alive
Content-Type: application/json;charset=UTF-8
X-BuildVersion: R10_1
Content-Security-Policy: default-src 'self' ; child-src blob: ; connect-src 'self' https://www.apple.com https://appleid.cdn-apple.com https://webcourier.sandbox.push.apple.com https://xp-qa.apple.com wss://websocket.push.apple.com ; font-src 'self' https://www.apple.com https://appleid.cdn-apple.com https://idmsa.apple.com https://gsa.apple.com https://idmsa.apple.com.cn https://signin.apple.com ; frame-src 'self' https://appleid.apple.com https://gsa.apple.com https://account.apple.com ; img-src 'self' https://www.apple.com https://appleid.cdn-apple.com https://*.mzstatic.com data: https://*.apple.com ; media-src data: ; object-src 'none' ; script-src 'self' https://www.apple.com https://appleid.cdn-apple.com https://idmsa.apple.com https://gsa.apple.com https://idmsa.apple.com.cn https://signin.apple.com ; style-src 'unsafe-inline' 'self' https://www.apple.com https://appleid.cdn-apple.com https://idmsa.apple.com https://gsa.apple.com https://idmsa.apple.com.cn https://signin.apple.com ;
X-FRAME-OPTIONS: DENY
Referrer-Policy: origin
scnt: <redacted_scnt>
Server: Apple

{
  "authType" : "hsa2"
}

2026-05-18T15:37:58+0200 debug xcodeinstall: [xcodeinstall]
 - - - - - - - - - -  END - - - - - - - - - -

2026-05-18T15:37:58+0200 debug xcodeinstall: [xcodeinstall] ⚠️ I could not load session (this is normal the first time you authenticate)
2026-05-18T15:37:58+0200 debug xcodeinstall: [xcodeinstall] ⚠️ I could not load cookies (this is normal the first time you authenticate)
2026-05-18T15:37:58+0200 debug xcodeinstall: [xcodeinstall]
 - - - - - - - - - - OUTGOING - - - - - - - - - -

2026-05-18T15:37:58+0200 debug xcodeinstall: [xcodeinstall] https://idmsa.apple.com/appleauth/auth


GET /appleauth/auth? HTTP/1.1

HOST: idmsa.apple.com
X-Apple-ID-Session-Id: <redacted_session_id>
Content-Type: application/json
X-Requested-With: XMLHttpRequest
User-Agent: curl/7.79.1
Accept: application/json, text/javascript
scnt: <redacted_scnt>
X-Apple-Widget-Key: <redacted_widget_key>

2026-05-18T15:37:58+0200 debug xcodeinstall: [xcodeinstall]
 - - - - - - - - - -  END - - - - - - - - - -

2026-05-18T15:37:58+0200 debug xcodeinstall: [xcodeinstall]
 - - - - - - - - - - INCOMING - - - - - - - - - -

2026-05-18T15:37:58+0200 debug xcodeinstall: [xcodeinstall] https://idmsa.apple.com/appleauth/auth

HTTP 200 /appleauth/auth?
Host: idmsa.apple.com
Vary: accept-encoding
X-Apple-AK-Auth-Type: hsa2
X-Apple-I-Request-ID: <req_id>
Referrer-Policy: origin
Connection: keep-alive
X-FRAME-OPTIONS: DENY
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Content-Security-Policy: default-src 'self' ; child-src blob: ; connect-src 'self' https://www.apple.com https://appleid.cdn-apple.com https://webcourier.sandbox.push.apple.com https://xp-qa.apple.com wss://websocket.push.apple.com ; font-src 'self' https://www.apple.com https://appleid.cdn-apple.com https://idmsa.apple.com https://gsa.apple.com https://idmsa.apple.com.cn https://signin.apple.com ; frame-src 'self' https://appleid.apple.com https://gsa.apple.com https://account.apple.com ; img-src 'self' https://www.apple.com https://appleid.cdn-apple.com https://*.mzstatic.com data: https://*.apple.com ; media-src data: ; object-src 'none' ; script-src 'self' https://www.apple.com https://appleid.cdn-apple.com https://idmsa.apple.com https://gsa.apple.com https://idmsa.apple.com.cn https://signin.apple.com ; style-src 'unsafe-inline' 'self' https://www.apple.com https://appleid.cdn-apple.com https://idmsa.apple.com https://gsa.apple.com https://idmsa.apple.com.cn https://signin.apple.com ;
Content-Language: en-US
Server: Apple
X-BuildVersion: R10_1
Set-Cookie: dslang=US-EN; Domain=apple.com; Path=/; Secure; HttpOnly, site=US; Domain=apple.com; Path=/; Secure; HttpOnly, dslang=US-EN; Domain=apple.com; Path=/; Secure; HttpOnly, site=US; Domain=apple.com; Path=/; Secure; HttpOnly
scnt: <redacted_scnt>
Content-Type: application/json;charset=UTF-8
Transfer-Encoding: Identity
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Apple-ID-Account-Country: US
Cache-Control: no-store, no-store
X-Apple-ID-Session-Id: <session id>
Date: Mon, 18 May 2026 13:37:58 GMT
X-Apple-Auth-Attributes: <redacted_attributes>
X-XSS-Protection: 1; mode=block

{
  "cancelled" : false,
  "accountName" : "<redacted_apply_id>",
  "keyNames" : [ "Key 1", "Key 2" ],
  "requirePrf" : false,
  "passkeyAutofill" : false,
  "fsaChallenge" : {
    "challenge" : "<redacted_challenge>",
    "keyHandles" : [ "<redacted keyhandle-1>", "<redacted keyhandle-2>" ],
    "rpId" : "apple.com",
    "allowedCredentials" : "<redacted keyhandle-1>,<redacted keyhandle-2>"
  }
}

2026-05-18T15:37:58+0200 debug xcodeinstall: [xcodeinstall]
 - - - - - - - - - -  END - - - - - - - - - -

[sebsto]

Thanks @daneov for the detailed report — this is very useful.

After investigating, supporting FIDO2 / physical security keys for the Apple Developer Portal sign-in is a significant new feature rather than a quick fix. A few notes on what I found:

• Apple's /appleauth/auth returns an fsaChallenge block (challenge, keyHandles, rpId, allowedCredentials) — this is essentially a WebAuthn PublicKeyCredentialRequestOptions payload. The browser takes that, talks CTAP2 to the YubiKey, and POSTs an assertion (clientDataJSON, authenticatorData, signature, userHandle, credentialId) back to Apple.
• Fastlane's spaceship does not implement this either — its two_step_or_factor_client.rb only handles trustedDevices (HSA) and trustedPhoneNumbers (HSA2) and raises on anything else. There's no reference implementation I can port.
• Doing it in Swift means either (a) bridging to Yubico's libfido2 C library, or (b) speaking CTAP2 over USB-HID directly with IOHIDManager. Neither is small, and Apple's AuthenticationServices API isn't usable from a CLI binary (it requires a GUI presentation anchor and an Associated Domain).
• I also need to capture the exact request developer.apple.com posts after the key signs the challenge — that endpoint isn't documented anywhere public.

Two practical blockers on my side: I don't own a YubiKey to test against, and I don't have the time right now to develop and validate this end-to-end. I'm leaving this issue open and have written up a detailed implementation plan in docs/fido2-mfa-plan.md (PR #139) so a contributor with both the hardware and the bandwidth can pick it up.

Workaround for now: if you can register a trusted phone number or a trusted Apple device on your account, the existing SMS / trusted-device flow will work. Apple does not currently provide an authentication-only API key that covers the developer download endpoints (App Store Connect API keys don't cover them — see docs/app-specific-passwords-analysis.md).