Field report

Oct 2026
AltServer on macOS 27

-80045

Apple closed the door.
Twice.

Authorkisnner26
Tested onmacOS 27.2 · iPadOS 27.2
Pull requestAltStore #1834
AltStore on an iPhone with 7 days remaining after the refresh
AltStore, signed in again
AltServer ↔ Anisette ↔ Apple

The failure

Issue #1828
What you see

Two errors.
One cause.

Installing AltStore from AltServer on macOS 27 failed at the very first sign-in request, before Apple ever looked at the password. Sideloadly, iloader, SideStore and xtool failed the same way, so the tool is not the problem.

AltServer dialog showing Apple.APIError -80045
Oct 12 · Apple.APIError -80045 at step init
AltServer dialog showing NSCocoaErrorDomain 3840, unknown tag html
Oct 15 · "Encountered unknown tag html"

What changed

Timeline
Two blocks, not one

Apple checks
that they agree.

01

Oct 5 · it works

AltServer signs in on macOS 27 with anisette data generated locally by AnisetteKit, which emulates Android's CoreADI.

02

Oct 12 · -80045

The anisette describes an Android device but the X-MMe-Client-Info header says Mac. Apple starts rejecting the mismatch. Declaring a Pixel client fixes it for a few hours.

03

Oct 14 · HTTP 503

From about 20:50 UTC, any Android client info gets a 503 Service Temporarily Unavailable HTML page, which AltServer tries to read as a property list.

The rule

The anisette and the client info must describe the same device.

Probing the edge

No credentials
Method and result

Ask the server.
Carefully.

Method

Credential-less requests to GsService2 with only the client info changed and an empty plist body.

Limit

They show how the edge routes a request, not whether a login would succeed.

Oct 15 · measured 03:40–04:30 UTC
X-MMe-Client-InfoResponseReading
<Pixel 7> <Android;14;…>503 HTML, 6 of 6blocked at the edge
<Pixel 5> and <Pixel 8> variants503 HTML, 6 of 6same
<MacBookPro…> <macOS;27.2;…> akd404 / 429reaches the service (my IP was rate-limited by then)
<PC> <Windows;6.2(0,0);9200> iTunes404reaches the service

The only recipe confirmed working after the 503 was the one iloader 2.3.8 and isideload 0.4.6 shipped: anisette from Windows' ADI on an anisette v3 server, with the client info and user agent that server reports.

A crash that wasn't the bug

Xcode 27
UML components · build chain

The framework
that was empty.

component [ AltServer · build with Xcode 27 ] «build»Xcode 27Builds thepackage product. «framework»AltSign-DynamicEmpty. No binary. «framework»AltSignBinds the SRPsymbol lazily. «archive»libcorecrypto_static.aBuilt. Linkedto nothing. «result»SIGSEGVNull call ataddress 0x0. «use»«use»«use»«use»

Porting the fix meant building AltServer with Xcode 27, and the first build that reached Apple crashed on its own. The faulting call was alt_ccsrp_gp_rfc5054_2048, a symbol AltSign binds through the flat namespace. It was undefined in every framework.

$ nm -arch arm64 AltSign.framework/Versions/A/AltSign | grep rfc5054
                 U _alt_ccsrp_gp_rfc5054_2048

$ clang -dynamiclib -arch arm64 -Wl,-force_load,libcorecrypto_static.a \
    -undefined dynamic_lookup -o AltSign-Dynamic.framework/Versions/A/AltSign-Dynamic

Rebuilding that one dylib from the static library removed the crash. It is a build issue and is deliberately not part of the pull request.

The fix

UML · sequence
How it works

Sign in
as who
you are.

AltServer asks.
The server provisions.
Apple checks the match.

Your password and your 2FA code go straight to Apple. The anisette server only sees a device identity.

sd [ AltServer · sign-in on macOS 27 ] UML · SEQUENCE :AltServer :Anisette :Apple GSA 1: client_info() 2: provision() 3: get_headers() 4: identity + OTP 5: init(server's client info + UA) 6: tokens (SRP · 2FA)
Before and after
BeforeAfter
AnisetteAndroid CoreADI, local (AnisetteKit)Windows ADI, anisette v3 server
User-AgentAuthKit/1 (Macintosh…) (com.apple.dt.Xcode/26.0)the server's user_agent
Extra headersnoneAccept, X-Xcode-Version, X-Apple-App-Info, Connection: close
cpd14 fields, booleans9 fields, strings
HTTP errorsplist parse error 3840readable HTTP status

Six commits in total, three in AltStore and three in AltSign. They build on the 2FA fix from AltSign#59 and reuse the fetcher from #1806.

Evidence

macOS 27.2 · free Apple ID · 2FA
Measured

It signs in.
It installs.

Installing AltStore from the downloaded build worked on an iPad Pro and on an iPhone 15 Pro Max, and refreshing AltStore from the app worked too. The 2FA code was generated on a trusted device, because the SMS option currently fails.

26requests during an install, all HTTP 200
6requests during a refresh, all HTTP 200
7days remaining after the refresh
1App ID used by the refresh (8 to 7)
AltStore My Apps on iPad showing AltStore with 7 days
iPad Pro · iPadOS 27.2
AltStore My Apps on iPhone showing AltStore with 7 days
iPhone 15 Pro Max · after refresh

Limits

What this doesn't do
Read before you rely on it

What this
doesn't do.

01
/ 03
Accounts

Not universal. Some accounts still get -80045 with the Windows identity, apparently depending on the account or the network.

nab138/iloader#928
02
/ 03
Third party

It depends on a community anisette server. SMS 2FA also fails on Apple's side, so use a code from a trusted device.

ani.jkcoxson.com
03
/ 03
Untested

Refreshing other sideloaded apps was not tested. And Apple can change the rules again: the first fix lasted less than a day.

Status · Oct 15