ipatool 2.3.2-sapfix.1 — macOS App Store login HTTP 403 fix

Fix ipatool auth login HTTP 403 on macOS

Ready-to-download macOS build of ipatool for searching, acquiring, and
downloading encrypted iOS IPA packages from the Apple App Store.

This prerelease fixes App Store authentication failing with:

request failed: unexpected response from Apple (HTTP 403): empty or non-plist body

The login request now includes Apple's required SAP action signature
(X-Apple-ActionSignature) generated through the macOS CommerceKit service.

Also included:

• passwords and two-factor authentication codes are excluded from --verbose logs;
• login redirect and plist response handling fixes;
• native macOS binaries for Apple Silicon (arm64) and Intel (amd64);
• SHA-256 checksum files with portable archive names.

Authentication in this build is macOS-only and requires cgo. The live App Store
login flow was verified on Apple Silicon. This is an unofficial standalone
community project based on majd/ipatool.

Install

Download both the archive for your Mac and its matching .sha256sum file.
Apple Silicon example:

shasum -a 256 -c ipatool-2.3.2-sapfix.1-macos-arm64.tar.gz.sha256sum
tar -xzf ipatool-2.3.2-sapfix.1-macos-arm64.tar.gz
sudo install -m 0755 bin/ipatool-2.3.2-sapfix.1-macos-arm64 /usr/local/bin/ipatool
ipatool --version

For Intel Macs, use the macos-amd64 archive and binary names.

Authenticate

ipatool auth login --email "you@example.com"

If macOS quarantine blocks the downloaded binary, verify its checksum before
removing the quarantine attribute. Never publish raw authentication logs.