Activity

1. M-Thoriq

   added

   bugSomething isn't workingSomething isn't working

   on Oct 14, 2026
2. Saswotb commented on Oct 14, 2026

   

   Saswotb

   on Oct 14, 2026

   More actions

   Same issue here:
   Select login mode
   0: API Key (requires paid Apple Developer Program membership)
   1: Password (works with any Apple ID but uses private APIs)
   Choice (0-1): 1
   Heads up:
   This works by emulating a Pixel phone/Windows PC to interact with Apple services;
   consider using a secondary Apple ID. Credentials are only ever sent to Apple.
   Apple ID: saswotbhattarai8@gmail.com
   Password:
   Logging in...
   Error: POST https://gsa.apple.com/auth/verify/phone/put?mode=sms failed: HTTP 403. Details:
   

           <alert message="Could not connect to iCloud" cancelButtonTitle="OK"/>
       </xmlui>
   

   wsl@DESKTOP-FO2VFOV:~$
3. Saswotb commented on Oct 14, 2026

   

   Saswotb

   on Oct 14, 2026

   More actions

   
4. NightmareFox12 commented on Oct 14, 2026

   

   NightmareFox12

   on Oct 14, 2026

   Last edited by NightmareFox12

   More actions

   Same issue: Arch Linux WSL

   Extra info that might help:

   • The account has 2FA and a trusted phone number; no Apple device registered.
   • Logging in to the same account on account.apple.com from an Android phone works
     and the SMS arrives normally, so the number is fine.
   • Same result after moving ~/.config/xtool and ~/.cache/xtool away (clean state).
   • VPN off; tried several times, identical error.

   
5. gonde20 commented on Oct 16, 2026

   

   gonde20

   on Oct 16, 2026

   More actions

   SMS 2FA verification fails with HTTP 403 on xTool 1.22.2

   Environment

   • OS: Windows 11 / WSL2 Ubuntu
   • xTool version: 1.22.2
   • Authentication: Apple ID / Password (Option 1)
   • Apple Account: SMS-based two-factor authentication enabled
   • No trusted Apple device signed in to this account

   Problem

   Unable to authenticate using xtool auth login. The authentication process fails when xTool requests SMS verification from Apple's GSA endpoint.

   The same error occurred on October 15 and 16, 2026.

   Error

   Error: POST https://gsa.apple.com/auth/verify/phone/put?mode=sms failed: HTTP 403. Details:
   <xmlui >
       <alert message="Could not connect to iCloud" cancelButtonTitle="OK"/>
   </xmlui>
   

   Additional findings

   • Apple web authentication works: I can successfully sign in to account.apple.com.
   • SMS verification works: Apple sends an SMS verification code during every browser login, and the code is successfully received.
   • Password change did not help: The error occurs with both the previous and newly updated Apple ID passwords.
   • Account recently unlocked: The Apple Account was recently unlocked, and normal web authentication works.
   • Reproducible: The same HTTP 403 error occurred on two consecutive days.

   Expected behavior

   xTool should request an SMS verification code and allow the user to complete two-factor authentication.

   Actual behavior

   Apple's GSA SMS verification endpoint responds with HTTP 403, and authentication fails before an SMS code can be entered.

   Additional context

   This appears related to xTool's SMS-based authentication flow rather than a general Apple Account login failure.

   Happy to provide additional diagnostic information if needed.

   👍React with 👍3Reacted by Muhammad Thoriq Al Asyjari, fooabobabar and Ahmed Adli
6. alfdev commented on Oct 16, 2026

   

   alfdev

   on Oct 16, 2026

   More actions

   Same here on Ubuntu :(
7. oneill-achille commented on Oct 16, 2026

   

   oneill-achille

   on Oct 16, 2026

   More actions

   Workarounds

   • Add a trusted device to the Apple ID. Open Settings, then Sign-In & Security. Apple should then return trustedDeviceSecondaryAuth, allowing GrandSlamTwoFactorAuthenticateOperation.swift to use the trusted-device authentication path
   • Use an API key if you have a paid Apple Developer Program membership. Select option 0 at the login prompt. This method bypasses GrandSlam authentication
   • build the latest commit from pull request gsa: fix login after Android client-info switch | Fix -80045 #348 on WSL2 and test the SMS verification path
8. kabiroberai commented on Oct 18, 2026

   

   kabiroberai

   on Oct 18, 2026 · Pinned by kabiroberai

   Member

   More actions

   Some suggestions:

   1. Adding a trusted device is the easiest solution (as @oneill-achille pointed out). You can add your iPhone as a trusted device to your Apple ID via Settings > Apps > Mail > Mail Accounts > Add Account.
   2. ASC API key should also do the trick + avoids any auth related breakages
   3. I don't think gsa: fix login after Android client-info switch | Fix -80045 #348 actually fixes this issue, but if someone else finds that it does please let me know
   4. You can also create an Apple Account without a phone number or 2FA, by going to https://music.apple.com and clicking "Sign in" to create a new account.
9. kabiroberai

   pinned a comment on Oct 18, 2026
10. kabiroberai

    changed the title [-]Error: POST failed: HTTP 403[/-] [+]Can't log in with SMS 2FA (HTTP 403)[/+] on Oct 18, 2026
11. kabiroberai

    pinned this issue on Oct 18, 2026