Always get "METHOD_NOT_ALLOWED" from App Store Connect API Post Requests

Question

I am working with App Store Connect API for the first time, from NodeJS (if that matters, but I also tried with curl).

I was able to authenticate and send GET requests with no problem, but when trying to send POST request I always get "METHOD_NOT_ALLOWED" error.

Is anyone able to send post request? specifically to "https://api.appstoreconnect.apple.com/v1/certificates", but I also tried the Profiles endpoint, and I got the same problem.

The docs claim its possible, but this error makes me feel something is not updated over there.

Any help will be very much appreciated!

Some extra information:

JWT Playload:

{
  iss:"KEY ISSUER",
  iat:Math.floor(Date.now() / 1000),
  exp:Math.floor(Date.now() / 1000) + (60 * 10),
  aud:'appstoreconnect-v1',
  scope:[
    'POST /v1/certificates'
  ]
}

JWT Options:

{
  algorithm:'ES256',
  header:{
    alg:'ES256',
    kid:"KEY ID",
    typ:'JWT'
  }
}

Request Body(Before Stringify):

{
  data:{
    type:'certificates',
    attributes:{
      certificateType:'IOS_DISTRIBUTION',
      csrContent:"PEM CERT"
    }
  }
}

kooskoos · Accepted Answer · 2023-08-31 06:53:09Z

5

The issue seems to be with the scope. It doesn't support POST. If you remove the scope key it should work fine.

Reference: https://developer.apple.com/documentation/appstoreconnectapi/generating_tokens_for_api_requests

edited Aug 31, 2023 at 6:53

answered Aug 31, 2023 at 6:45

kooskoos

4,9391 gold badge17 silver badges31 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

IdoPickle Over a year ago

You are a life saver! How could I miss that!

Adriano Over a year ago

I have the same issue, BUT I'm convinced this answer is incorrect. Of course, without a scope, the request works. But the JWT token is completely unrestricted, which is discouraged if not absolutely necessary. The mentioned section from the Apple docs refer explicitly to JWT tokens that need a longer lifetime than 20minutes. It mentions that for longer JWT token lifetime only requests with tokens limited to GET requests are allowed. @IdoPickle's example does not exceed 20min.

kooskoos Over a year ago

Hey @Adriano. Please, let us know if you happen to find the answer :)

Collectives™ on Stack Overflow

Always get "METHOD_NOT_ALLOWED" from App Store Connect API Post Requests

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related