Repository navigation
Conversation
Since October 13 Apple often pushes the verification code to trusted devices right after the password step. In that case the complete response has hsc 409 and no "au" value, so we used to skip 2FA, ask for app tokens right away and fail with -22411 (This action cannot be completed at this time). Now hsc 409 is treated like trustedDeviceSecondaryAuth, except that we don't request a new code because that would invalidate the one already sent. This also adds an optional anisetteDataRefreshHandler so that the code check, the second sign-in and the app token request can each use a fresh one-time password instead of reusing the one from the first request.
whydr4
added a commit
to whydr4/AltStore
that referenced
this pull request
Oct 14, 2026
Needed for the 2FA fix in rileytestut/AltSign#59, which this also bumps the AltSign submodule to.
Author
|
Quick note for whoever reviews this. #61 is built on top of this commit and switches GrandSlam requests to Windows anisette, which is what Apple accepts right now. The 2FA handling here doesn't depend on where the anisette data comes from, so it can go in on its own or together with #61, whichever is easier. |
jaakkopalvaila
pushed a commit
to jaakkopalvaila/AltServer-Windows
that referenced
this pull request
Oct 20, 2026
…ride Since 2026-10-13 Apple often pushes the verification code to trusted devices as soon as the password is accepted and answers the complete step with hsc 409 and no au. AltSign took that as no 2FA needed, went straight to apptokens and failed with -22411. Treat hsc 409 without au as trusted-device 2FA without requesting a second code, and refresh anisette data before validating the code and before the second sign-in. Port of rileytestut/AltSign#59. Also make the GrandSlam User-Agent overridable via ALTSERVER_GSA_USER_AGENT. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Owner
|
LGTM, thank you so much! I've merged this in and will be releasing an update to AltStore Classic + AltServer macOS with this change very soon 🙂 |
rileytestut
pushed a commit
to altstoreio/AltStore
that referenced
this pull request
Oct 21, 2026
Points AltSign at the GrandSlam changes needed to sign in with Windows anisette data: a configurable User-Agent, matching request headers, clear errors for HTTP failures and hsc 434 resync. Builds on top of rileytestut/AltSign#59 (2FA codes that Apple sends on its own).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Since October 13 signing in through AltSign breaks in two places. The first one is -80045 on the init request, which needs a fix in AltServer (altstoreio/AltStore#1832). Once that's out of the way, accounts with 2FA run into -22411 (This action cannot be completed at this time) right after the password step.
It turns out Apple now often pushes the verification code to trusted devices by itself as soon as the password is accepted. The complete response then comes back with hsc 409 and an empty au, so AltSign decides no second factor is needed, goes straight to apptokens, and Apple answers with -22411. I logged the GsService2 status for every step to make sure. The sequence was init with hsc 200, then complete with hsc 409 and no au, then apptokens failing with ec -22411 and hsc 401. isideload hit the same thing and handles 409 the same way (nab138/isideload@fdb1788).
With this change a 409 without au goes down the trusted device path. We skip the request to /auth/verify/trusteddevice in that case, because asking for another code makes the one already on the user's screen stop working. The code prompt shows up, validate succeeds and the second sign-in goes through.
I also added an optional anisetteDataRefreshHandler to ALTAppleAPI. When it's set, the code check, the second sign-in and the apptokens request each get fresh anisette data instead of reusing the one-time password from the very first request, which can easily be a minute old by the time someone types the code. isideload refreshes anisette before each of these steps too. If nothing sets the handler, behavior stays exactly as before.
Tested with AltServer on macOS 27.0.1, an iPhone 13 mini on iOS 27 and a free Apple ID with 2FA. Installing AltStore from AltServer works again, and so does refreshing apps from AltStore afterwards. I couldn't test the SMS path since my account only uses trusted devices.