[kisnner26]

Depends on: rileytestut/AltSign#61, which builds on rileytestut/AltSign#59. The Dependencies/AltSign submodule points to that branch until it is merged.

Fixes #1828.

Problem

Since October 12 2026, AltServer on macOS 27 can't sign in to Apple at all, so it can't install AltStore or refresh apps (#1828).

On macOS 27, AltServer generates anisette data locally with AnisetteKit, which emulates Android's CoreADI. Apple has been rejecting that in two stages:

Since	What Apple returns	What AltServer shows
Oct 12	ec -80045, hsc 500 on the first GsService2 request, because the anisette is Android but X-MMe-Client-Info says Mac	"AltServer could not sign in with your Apple ID. This action cannot be completed at this time. (-80045)"
Oct 14 (~20:50 UTC)	503 Service Temporarily Unavailable HTML page to any request that declares an Android client, including the Pixel 7 identity in #1832 and #1833 (nab138/iloader#920, #921)	"The data is not in the correct format." (NSCocoaErrorDomain 3840, "unknown tag html")

What still works is anisette data from Windows' ADI (iTunes), served by anisette v3 servers like ani.jkcoxson.com. The X-MMe-Client-Info and User-Agent sent to Apple must be the ones that server reports in /v3/client_info:

<PC> <Windows;6.2(0,0);9200> <com.apple.AuthKit/1 (com.apple.iTunes/12.12.4.1)>
akd/1.0 CFNetwork/808.1.4

nab138/isideload 0.4.6 / iloader 2.3.8 shipped the same approach on October 15.

Solution

On macOS 27, AltServer gets its anisette data from a Windows anisette v3 server instead of AnisetteKit, and signs in as that client.

AltServer ──/v3/client_info──────▶ ani.jkcoxson.com   Windows client_info + user_agent
          ──/v3/provisioning_session (websocket)─────▶  provisions a dedicated identity
          ──/v3/get_headers──────▶                    X-Apple-I-MD, X-Apple-I-MD-M
          ──GsService2 (SRP + 2FA)──────────────────▶ gsa.apple.com
             X-MMe-Client-Info = server's client_info
             User-Agent        = server's user_agent

Your Apple ID password and 2FA code only go to Apple. The anisette server only sees the anisette identity it provisions, as with AltStore's existing remote anisette support.

Commit	Change
feat: add an anisette v3 client to AltServer	RemoteAnisetteDataFetcher, based on @nickclyde's fetcher from #1806. It only accepts servers whose client_info identifies Windows. The URL bag lookup uses a Mac client info; provisioning uses the server's client info. The identity is stored in RemoteAnisetteWindows/identity.json, separate from AnisetteKit's. It re-provisions once on -45061 and supports X-Apple-I-MD-DATA resync. Defaults to https://ani.jkcoxson.com, overridable with defaults write com.rileytestut.AltServer AnisetteServerURL <url>. New AnisetteError cases.
fix: sign in with Windows anisette data on macOS 27	AnisetteDataManager uses the remote fetcher on macOS 27 and passes the server's user_agent to AltSign. AppDelegate sets AltSign's anisette refresh handler (as in #1832) and the new resync handler.
build: update AltSign	Points to the AltSign changes: configurable User-Agent, matching headers and cpd, readable HTTP errors, hsc 434 resync, and the 2FA fix from AltSign#59.

LocalAnisetteDataManager is left untouched, so it is easy to switch back if Apple accepts local Android anisette again.

Testing

Tested on macOS 27.2 (26B5091g), MacBook Pro M1, with an iPad Pro 12.9" (5th gen) on iPadOS 27.2 (24B5084k) over USB, and a free Apple ID with 2FA.

Build	Result
classic (fafd76e)	-80045 on GsService2 init
classic + #1832 (Pixel 7)	503 HTML → "The data is not in the correct format" (2026-10-15 03:40 UTC)
This branch	Sign-in, 2FA with a trusted-device code, certificate and provisioning succeeded. AltStore 2.3 installed, opens and shows 7 days remaining (2026-10-15 04:35 UTC).

• A probe without credentials with the Windows client_info returned 404 from GsService2 instead of the 503 HTML that Android client infos get, so the request is no longer blocked at the edge.
• An app previously installed with Xcode using the same Apple ID kept working, so the development certificate wasn't revoked.

Notes and limitations

• Third-party anisette server. Like AltStore's remote anisette mode, this depends on a community anisette v3 server that serves Windows anisette (ani.jkcoxson.com; ani2.stikstore.app works too). Servers that serve Android anisette (e.g. ani.sidestore.io, whose client_info still claims a Mac) are rejected by the fetcher, because Apple no longer accepts them.
• Not universal. Some users still get -80045 with the Windows identity (Even with 2.3.8 still getting -80045 error. Tried replacing with Pixel ID too, still occurs. 16e - iOS 27.0.1 nab138/iloader#928), apparently depending on the account or IP. SMS 2FA is broken on Apple's side (403); trusted-device codes work.
• AltStore's remote anisette mode (FetchAnisetteDataOperation) has the same Android problem and isn't changed here. Refreshing through AltServer should work, since AltStore then uses AltServer's anisette, but I haven't tested it yet.
• Building with Xcode 27 needs a few unrelated build fixes (deployment target, ldid linking, and SwiftPM producing an empty AltSign-Dynamic binary). They're not part of this PR.

Credits

@whydr4 (#1832, AltSign#59), @mattaltgear (#1833, AltSign#60), @nickclyde (#1806, remote anisette fetcher), @nab138 (isideload/iloader, Windows anisette approach), @jkcoxson (anisette server).

[kisnner26]

For people who can't wait for this to be merged: I attached the build I tested as an unofficial, temporary pre-release in my fork, with instructions, SHA-256 checksums and the patches it was built from: https://github.com/kisnner26/AltStore/releases/tag/v1.8-windows-anisette-unofficial

It's clearly marked as not official and unsigned, and it's meant to be replaced by an official AltServer as soon as a fix is released. Happy to remove it, or change how it's presented, if the team prefers.

The code under review here is the cleaned-up version of the same change. The binary was built from the earlier patches (same approach, different formatting/structure), so please review the PR diff and treat the release as a stopgap.

[kisnner26]

More test results, on the build from the release linked above (built from the earlier patches of the same change), macOS 27.2, free Apple ID with 2FA:

• Downloaded the release zip from GitHub, applied the quarantine flag as a browser would, removed it as the instructions say, and AltServer launched normally.
• "Install AltStore" from that copy worked on an iPad Pro (iPadOS 27.2) and on an iPhone 15 Pro Max.
• Refresh from the AltStore app on the iPhone (Refresh on the AltStore row, same Wi-Fi as the Mac) worked: 6 requests during the refresh, all HTTP 200 with no errors in AltServer's log, and the app went back to 7 days. The refresh used one App ID (8 to 7 remaining).
• An app installed with Xcode under the same Apple ID kept working, so the development certificate wasn't revoked.

Not tested: refreshing other sideloaded apps, or an account that gets -80045 with the Windows identity.

[sacca97]

@kisnner26 @rileytestut this could potentially work as a definitive solution? https://github.com/sacca97/os-findmy-e
(uses MacOS anisette data running under Unicorn, effectively faking a Mac without a Mac)

[kisnner26]

Thanks for the pointer, I haven't tried it, so I can't say if it's a definitive fix. From its README it's a different approach: Python on Linux, running Apple's CoreADI under Unicorn to make up a Mac, while this PR is Swift changes in AltStore and AltSign that use Windows anisette data from a community server. Its own status table says that creating certificates, App IDs or profiles and installing an app aren't shown yet, which is what AltServer needs, so it would need more work before it could replace this.

Whether to go that way is for the maintainers to decide.

[liuzhe1117]

open the server you provided ，https://ani.jkcoxson.com/ ，get an error

Is this the reason that the solution is not universal？

[kisnner26]

That page isn't what AltServer uses. The app calls /v3/client_info and the provisioning endpoints, and those answer fine from here (ani.jkcoxson.com and ani2.stikstore.app both return the Windows client info). The -45061 you see on the root page is a different thing and doesn't mean the server is down.

It isn't why this isn't universal. Some accounts still get -80045 even with a working Windows anisette server, apparently depending on the account or the network, and I can't say why. If you're trying it, please share the exact error text and your macOS version.

[liuzhe1117]

I get it，this only works on macOS 27+

Mac mini M1
macOS: 15.7.2 (24G325)

iPhone 15
iOS 26.6.1

I uninstalled the official AltStore and reinstalled it using "AltServer-Windows."

When "Remote AltServer" is disabled, I can refresh apps via a data cable.

However, when "Remote AltServer" is enabled, I receive an "-80045" error. This error occurs not only when refreshing apps but also when clicking "View App IDs."

I tested accessing https://ani.jkcoxson.com/v3/client_info and was able to retrieve the correct client information, so the issue does not lie on that end.

What additional information can I provide to help diagnose this problem?

[rileytestut]

This is very helpful, thanks a bunch! I've merged this in, and we've also used it as the basis to fix AltStore Classic itself. Planning to ship an update with this and your other AltSign fix very soon 🙂

[tomritzow]