Can't log in with SMS 2FA (HTTP 403) · Issue #345 · xtool-org/xtool · GitHub
Skip to content

Can't log in with SMS 2FA (HTTP 403) #345

Closed
Closed
Can't log in with SMS 2FA (HTTP 403)#345
Labels
bugSomething isn't working

Description

@M-Thoriq
M-Thoriq
opened on Oct 14, 2026

Description

I tried to setup my xtool, and I choose the second option which is using Apple ID. When the login started, theres this error showed up

Error: POST https://gsa.apple.com/auth/verify/phone/put?mode=sms failed: HTTP 403. Details:
<xmlui > <alert message="Could not connect to iCloud" cancelButtonTitle="OK"/> </xmlui>

Environment

Host OS (macOS/Linux/WSL): WSL 2 Ubuntu 26

Swift version: Swift 6.4.1

Xtool version: 1.22.2

Pinned by kabiroberai
@kabiroberaikabiroberaion Oct 19, 2026

Implementing a workaround in #349. After that lands, try the solution in discussion #368.

View full comment

Activity

  1. M-Thoriq
    added
    bugSomething isn't working
    on Oct 14, 2026

  2. Saswotb commented on Oct 14, 2026

    @Saswotb
    Saswotb
    on Oct 14, 2026

    Same issue here:
    Select login mode
    0: API Key (requires paid Apple Developer Program membership)
    1: Password (works with any Apple ID but uses private APIs)
    Choice (0-1): 1
    Heads up:
    This works by emulating a Pixel phone/Windows PC to interact with Apple services;
    consider using a secondary Apple ID. Credentials are only ever sent to Apple.
    Apple ID: saswotbhattarai8@gmail.com
    Password:
    Logging in...
    Error: POST https://gsa.apple.com/auth/verify/phone/put?mode=sms failed: HTTP 403. Details:

            <alert message="Could not connect to iCloud" cancelButtonTitle="OK"/>
    </xmlui>

    wsl@DESKTOP-FO2VFOV:~$

  3. Saswotb commented on Oct 14, 2026

    @Saswotb
    Saswotb
    on Oct 14, 2026
    Image

  4. NightmareFox12 commented on Oct 14, 2026

    @NightmareFox12
    NightmareFox12
    on Oct 14, 2026

    Same issue: Arch Linux WSL

    Extra info that might help:

    • The account has 2FA and a trusted phone number; no Apple device registered.
    • Logging in to the same account on account.apple.com from an Android phone works
      and the SMS arrives normally, so the number is fine.
    • Same result after moving ~/.config/xtool and ~/.cache/xtool away (clean state).
    • VPN off; tried several times, identical error.
    Image

  5. gonde20 commented on Oct 16, 2026

    @gonde20
    gonde20
    on Oct 16, 2026

    SMS 2FA verification fails with HTTP 403 on xTool 1.22.2

    Environment

    • OS: Windows 11 / WSL2 Ubuntu
    • xTool version: 1.22.2
    • Authentication: Apple ID / Password (Option 1)
    • Apple Account: SMS-based two-factor authentication enabled
    • No trusted Apple device signed in to this account

    Problem

    Unable to authenticate using xtool auth login. The authentication process fails when xTool requests SMS verification from Apple's GSA endpoint.

    The same error occurred on October 15 and 16, 2026.

    Error

    Error: POST https://gsa.apple.com/auth/verify/phone/put?mode=sms failed: HTTP 403. Details:
<xmlui >
    <alert message="Could not connect to iCloud" cancelButtonTitle="OK"/>
</xmlui>

    Additional findings

    • Apple web authentication works: I can successfully sign in to account.apple.com.
    • SMS verification works: Apple sends an SMS verification code during every browser login, and the code is successfully received.
    • Password change did not help: The error occurs with both the previous and newly updated Apple ID passwords.
    • Account recently unlocked: The Apple Account was recently unlocked, and normal web authentication works.
    • Reproducible: The same HTTP 403 error occurred on two consecutive days.

    Expected behavior

    xTool should request an SMS verification code and allow the user to complete two-factor authentication.

    Actual behavior

    Apple's GSA SMS verification endpoint responds with HTTP 403, and authentication fails before an SMS code can be entered.

    Additional context

    This appears related to xTool's SMS-based authentication flow rather than a general Apple Account login failure.

    Happy to provide additional diagnostic information if needed.

  6. alfdev commented on Oct 16, 2026

    @alfdev
    alfdev
    on Oct 16, 2026

    Same here on Ubuntu :(

  7. oneill-achille commented on Oct 16, 2026

    @oneill-achille
    oneill-achille
    on Oct 16, 2026

    Workarounds

    • Add a trusted device to the Apple ID. Open Settings, then Sign-In & Security. Apple should then return trustedDeviceSecondaryAuth, allowing GrandSlamTwoFactorAuthenticateOperation.swift to use the trusted-device authentication path
    • Use an API key if you have a paid Apple Developer Program membership. Select option 0 at the login prompt. This method bypasses GrandSlam authentication
    • build the latest commit from pull request gsa: fix login after Android client-info switch | Fix -80045 #348 on WSL2 and test the SMS verification path

  8. kabiroberai commented on Oct 18, 2026

    @kabiroberai
    kabiroberai
    on Oct 18, 2026
    Member

    Some suggestions:

    1. Adding a trusted device is the easiest solution (as @oneill-achille pointed out). You can add your iPhone as a trusted device to your Apple ID via Settings > Apps > Mail > Mail Accounts > Add Account.
    2. ASC API key should also do the trick + avoids any auth related breakages
    3. I don't think gsa: fix login after Android client-info switch | Fix -80045 #348 actually fixes this issue, but if someone else finds that it does please let me know
    4. You can also create an Apple Account without a phone number or 2FA, by going to https://music.apple.com and clicking "Sign in" to create a new account.
  9. kabiroberai
    pinned a comment on Oct 18, 2026
  10. kabiroberai
    changed the title [-]Error: POST failed: HTTP 403[/-] [+]Can't log in with SMS 2FA (HTTP 403)[/+] on Oct 18, 2026
  11. kabiroberai
    pinned this issue on Oct 18, 2026

  12. PeterGourav commented on Oct 18, 2026

    @PeterGourav
    PeterGourav
    on Oct 18, 2026

    The workaround of adding an iPhone as a trusted device doesn't work either.
    At least not for me, please let me know if it worked for someone else.

  13. kabiroberai commented on Oct 19, 2026

    @kabiroberai
    kabiroberai
    on Oct 19, 2026 · Pinned by kabiroberai
    Member

    Implementing a workaround in #349. After that lands, try the solution in discussion #368.

  14. M-Thoriq commented on Oct 19, 2026

    @M-Thoriq
    M-Thoriq
    on Oct 19, 2026
    Author

    Description

    I tried to setup my xtool, and I choose the second option which is using Apple ID. When the login started, theres this error showed up

    Error: POST https://gsa.apple.com/auth/verify/phone/put?mode=sms failed: HTTP 403. Details:
    <xmlui > <alert message="Could not connect to iCloud" cancelButtonTitle="OK"/> </xmlui>

    Environment

    Host OS (macOS/Linux/WSL): WSL 2 Ubuntu 26

    Swift version: Swift 6.4.1

    Xtool version: 1.22.2

    UPDATE :
    The solution 2 on discussion#368 works for me.

    I also tried the solution 3 (creating account using music.apple.com) , but they just locks my account immediately when i tried to login on xtool. Maybe i should wait a few hours after creating my account before login on xtool, further investigation is needed on that solution

  15. M-Thoriq
    closed this as completedon Oct 19, 2026
  16. kabiroberai
    pinned a comment and unpinned a comment on Oct 19, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions