Error ITMS-4088 when submitting iOS builds from CI

Summary

In our CI build, we’re building and submitting an Expo App via CLI:

eas build --non-interactive --platform=all --profile=preview --auto-submit

This works for Android, but iOS submission fails with:

ERROR ITMS-4088: "The organization ((our company)) does not have permission to modify the application with the Apple ID 123456789. Please try again, using an account for an organization with access to this application." at SoftwareAssets
Invalid AdamId: 123456789.

Same same issue occurs if I split the eas build and eas submit commands, so it does not seem to be related to --auto-submit.

The same exact command works when run from my dev machine.

We’re developing an app for another company ((their company)), so there are multiple Developer Teams involved. The Distribution Certificate and Provisioning Profile assigned to the app both relate to ((their company)) in the expo.dev Web UI. Our eas.json specifies the ascAppId, but no apple team ids.

I noticed that the output of the submit command is different on CI: On my machine:

- Linking to project @the/project
✔ Linked to project @the/project(​https://expo.dev/accounts/the/projects/project)

ASC App ID:  1234567890
Project ID:  ...
Apple ID:   our.apple.id

On the CI:

- Linking to project @the/project
✔ Linked to project @the/project(​https://expo.dev/accounts/the/projects/project)

Looking up credentials configuration for com.bundle.identifier...
✔ App Store Connect API Key already set up.
Using API Key ID: 7A8W74KWY2 ([Expo] EAS Submit p548nhOiPM)     

ASC App ID:                 1234567890
Project ID:                 ....
App Store Connect API Key:  
    Key Name  :  [Expo] EAS Submit p548nhOiPM
    Key ID    :  7A8W74KWY2
    Key Source:  EAS servers

So this looks like EAS is picking up some environmental configuration on my dev machine that is not available on CI.

Managed or bare?

Managed

Environment

Environment on our CI container:

  EAS CLI 0.39.0 environment info:
    System:
      OS: Linux 4.15 Alpine Linux
      Shell: 1.33.1 - /bin/ash
    Binaries:
      Node: 14.17.6 - /usr/bin/node
      npm: 7.17.0 - /usr/bin/npm
    Utilities:
      Git: 2.32.0 - /usr/bin/git
    npmPackages:
      expo: ^43.0.3 => 43.0.3
      expo-dev-client: ~0.6.3 => 0.6.3
      react: 17.0.1 => 17.0.1
      react-dom: 17.0.1 => 17.0.1
      react-native: 0.64.3 => 0.64.3
      react-native-web: 0.17.1 => 0.17.1
    npmGlobalPackages:
      eas-cli: 0.39.0
    Project workflow: managed

Error output

[logs] Starting iOS app upload
[logs] Downloading archive
[logs] Preparing artifact
[logs] Uploading iOS app to TestFlight...
[logs] Creating ascApiJsonKey.json file with ASC credentials 
[logs] Uploading the app with fastlane
[logs] -------------------
[logs] --- Step: pilot ---
[logs] -------------------
[logs] Creating authorization token for App Store Connect API
[logs] Ready to upload new build to TestFlight (App: 1234567890)...
[logs] Going to upload updated app to App Store Connect
[logs] This might take a few minutes. Please don't interrupt the script.
[logs] Transporter transfer failed.
[logs] 
[logs] ERROR ITMS-4088: "The organization ((out company)) does not have permission to modify the application with the Apple ID 1234567890. Please try again, using an account for an organization with access to this application." at SoftwareAssets
[logs] Invalid AdamId: 1234567890.
[logs] [iTMSTransporter]  (1102)
[logs] 
[logs] [iTMSTransporter] [2021-12-06 10:16:35 PST] <main> DBG-X:   parameter ShouldUseRESTAPIs = false
[logs] 
[logs] [iTMSTransporter] [2021-12-06 10:16:35 PST] <main> ERROR: ERROR ITMS-4088: "The organization ((out company)) does not have permission to modify the application with the Apple ID 1234567890. Please try again, using an account for an organization with access to this application." at SoftwareAssets
[logs] 
[logs] [iTMSTransporter] [2021-12-06 10:16:35 PST] <main> ERROR: Invalid AdamId: 1234567890.
[logs] 
[logs] [iTMSTransporter] [2021-12-06 10:16:35 PST] <main> DBG-X: The error code is: 1102
[logs] 
[logs] [iTMSTransporter]
[logs] 
[logs] [iTMSTransporter]
[logs] 
[logs] [iTMSTransporter]
[logs] 
[logs] [iTMSTransporter] Package Summary:
[logs] 
[logs] [iTMSTransporter]
[logs] 
[logs] [iTMSTransporter] 1 package(s) were not uploaded because they had problems:
[logs] 
[logs] [iTMSTransporter]        /var/folders/97/73j93h690g9gdn54bh_zskm40000gn/T/d20211206-61993-yhxw7a/1234567890-67c0079e-e6fa-4234-b87c-fac158db1c74.itmsp - Error Messages:
[logs] 
[logs] [iTMSTransporter]                ERROR ITMS-4088: "The organization ((out company)) does not have permission to modify the application with the Apple ID 1234567890. Please try again, using an account for an organization with access to this application." at SoftwareAssets
[logs] 
[logs] [iTMSTransporter]                Invalid AdamId: 1234567890.
[logs] 
[logs] [iTMSTransporter] [2021-12-06 10:16:35 PST] <main> DBG-X: Returning 1
[logs] 
[logs] iTunes Transporter output above ^
[logs] ERROR ITMS-4088: "The organization ((out company)) does not have permission to modify the application with the Apple ID 1234567890. Please try again, using an account for an organization with access to this application." at SoftwareAssets
[logs] Invalid AdamId: 1234567890.
[logs] Return status of iTunes Transporter was 1: ERROR ITMS-4088: "The organization ((out company)) does not have permission to modify the application with the Apple ID 1234567890. Please\nInvalid AdamId: 1234567890.for an organization with access to this application." at SoftwareAssets
[logs] The call to the iTMSTransporter completed with a non-zero exit status: 1. This indicates a failure.
[logs] [!] Error uploading ipa file:
[logs]  [Transporter Error Output]: ERROR ITMS-4088: The organization ((out company)) does not have permission to modify the application with the Apple ID 1234567890. Please try again, using an account for an organization with access to this application. at SoftwareAssets
[logs] [Transporter Error Output]: Invalid AdamId: 1234567890.
[logs] [Transporter Error Output]: Return status of iTunes Transporter was 1: ERROR ITMS-4088: The organization ((out company)) does not have permission to modify the application with the 
\nInvalid AdamId: 1234567890.ry again, using an account for an organization with access to this application. at SoftwareAssets
[logs] [Transporter Error Output]: The call to the iTMSTransporter completed with a non-zero exit status: 1. This indicates a failure.
[logs] fastlane pilot failed

Reproducible demo or steps to reproduce from a blank project

Since this depends on multi-team Submit configuration and not source code, I cannot provide a demo here.

Here’s the relevant part of our eas.json

  "submit": {
    "preview": {
      "ios": {
        "appleId": "our.apple.id",
        "ascAppId": "1234567890"
      }
    },
  }

[barthap]

failing build is using app store aconnect API key and successful one is using app-specific password specified via EXPO_APPLE_APP_SPECIFIC_PASSWORD. Based on the error message it looks like asc api key is correct, but it was generated for the wrong apple account(or the account does not have correct permissions).

I suspect the same, especially when you say about ((their company)) and ((our company)). Maybe you generated key for our company instead of their 😉

[wkozyra95]

failing build is using app store aconnect API key and successful one is using app-specific password specified via EXPO_APPLE_APP_SPECIFIC_PASSWORD. Based on the error message it looks like asc api key is correct, but it was generated for the wrong apple account(or the account does not have correct permissions).