403: Unauthorized received on accounts with two-factor enabled.

[evertwoud]

When trying downloading a version using the install command using a device that has two-factor enabled a 403: Unauthorized is shown.
The username & password are correctly entered and when running the command a two-factor code is shown on the device itself.
The terms & conditions are setup correctly and there are no other weird restrictions on the account(s) (I've tested multiple).

evertwoud@evertwoud ~ % xcodes install 26.4.1

(1/6) Found existing archive that will be used for installation at /Users/evertwoud/Library/Application Support/com.robotsandpencils.xcodes/Xcode-26.4.1+17E202.xip.
(2/6) Unarchiving Xcode (This can take a while)
Using regular unxip. Try passing `--experimental-unxip` for a faster unxip process
The archive "Xcode-26.4.1+17E202.xip" is damaged and can't be expanded.
Removing damaged XIP and re-attempting installation.


Downloading with aria2 (/opt/homebrew/bin/aria2c)

 Received 403: Unauthorized. This can happen when either:
 1. Apple Developer Terms and Conditions were not accepted at https://developer.apple.com/
 2. Apple ID authorization was revoked for some other reason

[harrimaatta]

I can confirm this observation. I've encountered the same issue and have tested it with multiple user accounts as well. I also changed the account passwords via https://account.apple.com/account/manage, as suggested in #395 for another sign-in related issue. Unfortunately, this did not have the desired effect.

[pullely-samuel]

I can reproduce this with xcodes 2.0.1 on macOS 26.5.1 using an Apple ID with 2FA enabled. The latest Apple Developer agreements have been accepted.

Authentication triggers the trusted-device verification prompt, but the download produces a very small invalid .xip. After xcodes detects and removes it, retrying fails with 403 Unauthorized.

[Ybalrid]

Same exact issue occurring for me

[rocker1976]

Indeed, starting on Friday, I began receiving the following error message:

Downloading with aria2 (/opt/homebrew/bin/aria2c)

Received 403: Unauthorized. This can happen when either:

1. Apple Developer Terms and Conditions were not accepted at https://developer.apple.com/
2. Apple ID authorization was revoked for some other reason

[NicFontana]

Same here.

Also, I receive the SMS from Apple with the code for 2FA, indicating that the verification flow has began, but we don't have a chance to insert the code from the CLI.

[kinoroy]

Workaround is to downgrade to 1.6.2. Looks like 2.x.x has some significant auth refactors from the release notes:

Apple ID authentication now uses XcodesLoginKit.

[MattKiazyk]

cheers - I can duplicate so I'll get that fixed up

[kinoroy]

Opened a PR to fix this: #481

Tested against SMS and trusted-device 2FA and both working

[MattKiazyk]

2.0.2 should now be available brew upgrade xcodesorg/made/xcodes

[tomassliz]

I’m encountering the same issue with the latest Xcode beta, version 2.0.3.

$ xcodes install --experimental-unxip --empty-trash --data-source apple "27.0 Beta 4"

Two-factor authentication is enabled for this account.

Enter "sms" without quotes to exit this prompt and choose a phone number to send an SMS security code to.
Enter the 6 digit code from one of your trusted devices:435307

Downloading with aria2 (/opt/homebrew/bin/aria2c)

 Received 403: Unauthorized. This can happen when either:
 1. Apple Developer Terms and Conditions were not accepted at https://developer.apple.com/
 2. Apple ID authorization was revoked for some other reason