App Store Connect two-factor authentication failed in CI: fastlane session error fix

TL;DR

Stop using interactive Apple ID sessions in CI and switch the lanes to an App Store Connect API key, which has no two-factor step. If you must keep a session temporarily, generate it on a logged-in machine with fastlane spaceauth and store the session as a CI secret, refreshing it when it expires roughly monthly. Session cookies tied to an individuals Apple ID are the fragile path; API keys are the durable one.

App Store Connect two-factor authentication failed in CI: fastlane session error

Use this when

• CI lanes fail at login or two-factor when fastlane uses an Apple ID.
• The session secret expired or the account enabled a new trusted device flow.
• A teammates personal Apple ID carries the CI login.

Not for this skill when

• API key lanes return 401. That is a key configuration issue covered by the API key skill, not a session problem.
• The Apple ID is locked for security reasons. Unlock it in the account portal before any CI work.

Steps

1. Identify which lanes still authenticate with a username and session instead of an API key. Verify: each lanes authentication method is listed
2. Create an App Store Connect API key with the role the lanes need, typically App Manager or Admin for uploads. Verify: the key exists in Users and Access with the right role
3. Store the key file and identifiers in CI secrets and add the api key action to the Fastfile before the upload actions. Verify: the Fastfile loads the API key at lane start
4. Remove username and session parameters from those lanes so nothing falls back to interactive login. Verify: no lane references the session secret
5. Run the full release lane in CI. Verify: the lane uploads with no login or two-factor prompt in the log
6. If a lane genuinely needs a session-only feature, generate a fresh spaceauth session interactively, store it, and calendar its refresh. Verify: the exception lane works and a refresh reminder exists
7. Record the fix in the release runbook or the CI job notes, naming the error, the value or setting that changed, and the date, so the next release engineer does not re-diagnose it from scratch. Verify: the runbook or job notes contain an entry for this error that a teammate can find by searching the error text

Why it happens

Apple ID sign-ins are designed for humans: two-factor prompts, trusted devices and sessions that decay. CI inherits all of that fragility when lanes log in as a person. The App Store Connect API key exists precisely to give automation a non-interactive credential, and Apple has steadily moved fastlane workflows onto it for this reason.

In practice this failure is rarely a one-off. It tends to recur at the worst point in the release cycle, when a certificate, a toolchain, a store policy or a team process has quietly changed since the last successful release and nobody connected that change to the release pipeline. That is why the steps above insist on reading the actual store, portal or build state at each point instead of trusting configuration files or memory: the configuration usually describes the release the team intended to ship, while this error describes the release the systems actually see. Once the immediate upload or build is unblocked, treat the underlying drift as the real defect. Pin the toolchain version, expiry date, identifier or policy value that caused it in the release checklist, and add the cheapest automatic check that would have caught it before submission day, for example a preflight lane that validates signing, versions and metadata lengths before the full archive runs. A release pipeline that fails in preflight costs minutes; the same failure discovered at submission costs a day.

Variants and edge cases

fastlane two-factor CI session expired fix

Session phrasing; regenerate via spaceauth only as a stopgap. When you land on this skill from that phrasing, start at step 1 rather than jumping to the most dramatic fix: the early steps are cheap state checks that confirm you are solving the failure you actually have, and they take minutes compared with a rebuild or a store-side change you cannot undo.

FASTLANE_SESSION CI two factor failed

Secret-name phrasing; better to remove the dependency entirely. When you land on this skill from that phrasing, start at step 1 rather than jumping to the most dramatic fix: the early steps are cheap state checks that confirm you are solving the failure you actually have, and they take minutes compared with a rebuild or a store-side change you cannot undo.

Edge case: app-specific passwords

Some legacy actions asked for app-specific passwords. Modern lanes should not need one once on API keys. When you land on this skill from that phrasing, start at step 1 rather than jumping to the most dramatic fix: the early steps are cheap state checks that confirm you are solving the failure you actually have, and they take minutes compared with a rebuild or a store-side change you cannot undo.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstIJPCqwryoUF-kgOKjx7ng