Apple 2FA SMS code rejected as 'Invalid code' — code works in browser

[mboa-inc]

Summary

Apple 2FA SMS codes are consistently rejected as "Invalid code" when authenticating via EAS CLI, even though the same code works immediately on Apple's website. This makes it impossible to authenticate with Apple through EAS CLI for credential management.

Environment

• eas-cli: 18.5.0 and 18.7.0
• macOS: Darwin 25.4.0 (arm64)
• Node: v22.19.0

Steps to reproduce

1. Run eas build --platform ios --profile production or eas credentials --platform ios
2. Select "Yes" to log in to Apple account
3. Enter Apple ID credentials (password accepted from Keychain)
4. Receive SMS 2FA code
5. Enter the code immediately upon receipt
6. Code is rejected as "Invalid code"
7. Same code entered again — rejected again
8. Go to appleid.apple.com in browser, sign in with same credentials — same SMS code works fine

Workaround

Using App Store Connect API Key via environment variables (EXPO_ASC_API_KEY_PATH, EXPO_ASC_KEY_ID, EXPO_ASC_ISSUER_ID) bypasses 2FA entirely and works for non-interactive builds.

Related issues

• Apple 2FA SMS code rejected (“Invalid code”) when logging in via EAS CLI on Windows — code works in browser #3309
• Problem with Apple 2FA SMS #2926
• EAS build, Apple verification code via call is not accepted #879
• Apple Authentication error running "eas build" and selecting phone number for 2FA #2738

This appears to be the same underlying issue reported multiple times. The SMS 2FA flow in EAS CLI seems fundamentally broken for some accounts.

[2bTwist]

I am experiencing the exact same issue!