Apple ID sign-in works again after Apple's second change on 2026-10-22: Apple error -80046: This action cannot be completed at this time. at the final token request, after your password and verification code were accepted. It also hit AltStore, SideStore, Impactor, Sideloadly and xtool (#9, #10).
Why it broke. Apple now refuses sign-in for anisette generated by Apple's Android libraries, which is what iPASide made on your PC, whatever device identity is claimed. xtool's maintainer put it this way: Apple blocks the GrandSlam login APIs for Android client strings. Every open-source sideloader has moved to the same fix.
What changed. iPASide now gets anisette from a Mac anisette service, using the community "v3" protocol that iloader and xtool use (SideStore lists the same servers). Each install makes its own random identity and provisions it once, through the service, with Apple directly; after that one HTTPS request returns fresh headers. Three servers are tried in order (mac-ani.jkcoxson.com, new.ani.sidestore.io, ani3.stikstore.app), so one being down does not stop sign-in. Everything a server sends back is validated before it is used, and all connections verify TLS.
What the service can and cannot see. It never receives your Apple ID, password, verification code, session token, pairing file or any app. Your sign-in still goes straight from your PC to Apple. The service can see your IP address, the random identifier, and the opaque provisioning data it relays. Settings → Anisette shows which service is active and says this. Set IPASIDE_ANISETTE_SERVER to use your own server; the old local emulator is still there as IPASIDE_ANISETTE=local, for diagnosis only, because Apple no longer accepts it.
Also in 1.2.8, if you are upgrading from earlier: two-factor sign-in for accounts where Apple sends the code during sign-in (-22411), and %LOCALAPPDATA%\iPASide\gsa-trace.log, which records one line per Apple sign-in request (step, HTTP status, Apple's error code) and never a password, token or response body. Attach it to a sign-in report.
Verified. A live sign-in with SMS two-factor, through the token step that fails for others. A real sideload of Dopamine over Wi-Fi from the installed app: provision, sign and install, with a new certificate and App IDs created. Apple's developer services read back the team, certificates and App IDs. 615 engine tests and 795 app tests pass; the new provider was tested against a real loopback server speaking the same protocol, and 12 deliberate breaks of it were all caught; CI built the installer on a clean machine.
Not verified. Automatic refresh of an already-installed app, and accounts other than the one tested. Apple has changed this rule several times since 2026-10-12, and a Mac service could be blocked as the Android and Windows routes were, so it may need further updates.
The installer is unsigned, so SmartScreen will warn — the SHA-256 is in SHA256SUMS.txt.