Fix rclone iCloud backend Invalid Session Token error
Apple deprecated the plaintext auth endpoint rclone's iCloud backend used; the fix is to update to rclone v1.74.0+, which uses the new SRP protocol. Includes a stopgap for users stuck on older stable releases.
Symptom
rclone fails to connect to an iCloud Drive remote with an Invalid Session Token error, often working previously and breaking without any local config change.
Root cause
Apple deprecated the plaintext password-posting auth endpoint rclone's iCloud backend relied on, replacing it with SRP, Secure Remote Password. Any rclone build predating the SRP rewrite fails this handshake permanently, not intermittently.
Fix
- Update rclone to v1.74.0 or later. This alone resolves the error for most users.
- If two-factor authentication fails after updating and your Apple ID contains uppercase letters, this is a known follow-up bug since SRP hashes are case sensitive, fixed shortly after the initial SRP release. Make sure you are on the latest patch, not just anything at or above 1.74.0.
If you cannot update yet
Extract iCloud session cookies from a browser login and inject them into rclone.conf manually. This is a stopgap, not a fix. Plan to update instead of maintaining a cookie refresh workflow.
Do not
Do not attempt to patch the old plaintext auth flow yourself, or store iCloud Apple ID passwords in plaintext in scripts or config as some early workarounds attempted. The SRP requirement exists because Apple deprecated the insecure path for a reason.