Invalid email/password combination produces a JSON dump

[lindenmj]

Overview

Around version 1.29.x or so, one of my accounts stopped working while another account still worked. The bad account credentials did not change and icloudpd began dumping a JSON output that I had not seen before on previous authentication problems. This persists even with the latest version, 1.32.1.

Steps to Reproduce

1. Running Ubuntu 20.04.06, command line
2. sudo icloudpd -u user@email.com -p PASSWORD -d "<DIRECTORY WITH A SPACE>" --cookie-directory /cookie/directory/with/no/spaces --set-exif-datetime --auto-delete

Expected Behavior

I expected the app to begin downloading photos using the arguments I've assigned, as it has done in the past.

Actual Behavior

It produces this in the console:

2025-09-01 08:56:12 INFO     Processing user: user@email
2025-09-01 08:56:12 DEBUG    Authenticating...
iCloud Password for user@email:
2025-09-01 08:56:19 INFO     Invalid email/password combination.
2025-09-01 08:56:19 DEBUG    {
  "request": {
    "method": "POST",
    "url": "https://idmsa.apple.com/appleauth/auth/signin/init",
    "headers": {
      "Origin": "https://idmsa.apple.com",
      "Referer": "https://idmsa.apple.com/",
      "Content-Type": "application/json",
      "X-Apple-OAuth-Client-Id": "OBFUSCATED-810530919",
      "X-Apple-OAuth-Client-Type": "OBFUSCATED-1961643734",
      "X-Apple-OAuth-Redirect-URI": "OBFUSCATED-1866116011",
      "X-Apple-OAuth-Require-Grant-Code": "OBFUSCATED-4261170317",
      "X-Apple-OAuth-Response-Mode": "OBFUSCATED-1578278625",
      "X-Apple-OAuth-Response-Type": "OBFUSCATED-1997877400",
      "X-Apple-OAuth-State": "OBFUSCATED-1322006840",
      "X-Apple-Widget-Key": "OBFUSCATED-810530919",
      "scnt": "OBFUSCATED-1080461492",
      "X-Apple-ID-Session-Id": "OBFUSCATED-1939794523"
    },
    "cookies": {
      "dslang": "US-EN",
      "site": "USA",
      "aasp": "OBFUSCATED-1939794523"
    },
    "content": {
      "a": "OBFUSCATED-2665417089",
      "accountName": "OBFUSCATED-2149657519",
      "protocols": [
        "s2k",
        "s2k_fo"
      ]
    }
  },
  "response": {
    "status_code": 200,
    "headers": {
      "Content-Type": "application/json;charset=UTF-8",
      "X-Apple-I-Request-ID": "OBFUSCATED-2888085107",
      "scnt": "OBFUSCATED-450725492"
    },
    "cookies": {
      "dslang": "US-EN",
      "site": "USA"
    }
  }
}
2025-09-01 08:56:19 DEBUG    {
  "request": {
    "method": "POST",
    "url": "https://idmsa.apple.com/appleauth/auth/signin/complete?isRememberMeEnabled=true",
    "headers": {
      "Origin": "https://idmsa.apple.com",
      "Referer": "https://idmsa.apple.com/",
      "Content-Type": "application/json",
      "X-Apple-OAuth-Client-Id": "OBFUSCATED-810530919",
      "X-Apple-OAuth-Client-Type": "OBFUSCATED-1961643734",
      "X-Apple-OAuth-Redirect-URI": "OBFUSCATED-1866116011",
      "X-Apple-OAuth-Require-Grant-Code": "OBFUSCATED-4261170317",
      "X-Apple-OAuth-Response-Mode": "OBFUSCATED-1578278625",
      "X-Apple-OAuth-Response-Type": "OBFUSCATED-1997877400",
      "X-Apple-OAuth-State": "OBFUSCATED-1322006840",
      "X-Apple-Widget-Key": "OBFUSCATED-810530919",
      "scnt": "OBFUSCATED-1080461492",
      "X-Apple-ID-Session-Id": "OBFUSCATED-1939794523"
    },
    "cookies": {
      "dslang": "US-EN",
      "site": "USA",
      "aasp": "OBFUSCATED-1939794523"
    },
    "content": {
      "accountName": "OBFUSCATED-2149657519",
      "c": "OBFUSCATED-1942856417",
      "m1": "OBFUSCATED-3016782708",
      "m2": "OBFUSCATED-3663754350",
      "rememberMe": true,
      "trustTokens": []
    }
  },
  "response": {
    "status_code": 401,
    "headers": {
      "Content-Type": "application/json;charset=UTF-8",
      "X-Apple-I-Request-ID": "OBFUSCATED-218088663",
      "scnt": "OBFUSCATED-1875386351"
    },
    "cookies": {
      "dslang": "US-EN",
      "site": "USA"
    }
  }
}

[AndreyNikiforov]

I see you are supplying password through cli and it may be subject shell substitution. Try removing it and specifying only one --password-provider console. It is strange to me that the app asks for password through console though...

[lindenmj]

I receive the same error and similar output:

sudo icloudpd -u user@email -d "DIRECTORY WITH A SPACE"  --cookie-directory /cookie/directory/ --set-exif-datetime --auto-delete --password-provider console

2025-09-01 09:23:18 INFO     Processing user: user@email
2025-09-01 09:23:18 DEBUG    Authenticating...
iCloud Password for user@email: <ENTERED PASSWORD>
2025-09-01 09:23:26 INFO     Invalid email/password combination.
2025-09-01 09:23:26 DEBUG    {
  "request": {
    "method": "POST",
    "url": "https://idmsa.apple.com/appleauth/auth/signin/init",
    "headers": {
      "Origin": "https://idmsa.apple.com",
      "Referer": "https://idmsa.apple.com/",
      "Content-Type": "application/json",
      "X-Apple-OAuth-Client-Id": "OBFUSCATED-810530919",
      "X-Apple-OAuth-Client-Type": "OBFUSCATED-1961643734",
      "X-Apple-OAuth-Redirect-URI": "OBFUSCATED-1866116011",
      "X-Apple-OAuth-Require-Grant-Code": "OBFUSCATED-4261170317",
      "X-Apple-OAuth-Response-Mode": "OBFUSCATED-1578278625",
      "X-Apple-OAuth-Response-Type": "OBFUSCATED-1997877400",
      "X-Apple-OAuth-State": "OBFUSCATED-1322006840",
      "X-Apple-Widget-Key": "OBFUSCATED-810530919",
      "scnt": "OBFUSCATED-1875386351",
      "X-Apple-ID-Session-Id": "OBFUSCATED-1939794523"
    },
    "cookies": {
      "dslang": "US-EN",
      "site": "USA",
      "aasp": "OBFUSCATED-1939794523"
    },
    "content": {
      "a": "OBFUSCATED-343724356",
      "accountName": "OBFUSCATED-2149657519",
      "protocols": [
        "s2k",
        "s2k_fo"
      ]
    }
  },
  "response": {
    "status_code": 200,
    "headers": {
      "Content-Type": "application/json;charset=UTF-8",
      "X-Apple-I-Request-ID": "OBFUSCATED-1649197559",
      "scnt": "OBFUSCATED-801434447",
      "X-Apple-ID-Session-Id": "OBFUSCATED-2950245712"
    },
    "cookies": {
      "dslang": "US-EN",
      "site": "USA",
      "aasp": "OBFUSCATED-2950245712"
    }
  }
}
2025-09-01 09:23:26 DEBUG    {
  "request": {
    "method": "POST",
    "url": "https://idmsa.apple.com/appleauth/auth/signin/complete?isRememberMeEnabled=true",
    "headers": {
      "Origin": "https://idmsa.apple.com",
      "Referer": "https://idmsa.apple.com/",
      "Content-Type": "application/json",
      "X-Apple-OAuth-Client-Id": "OBFUSCATED-810530919",
      "X-Apple-OAuth-Client-Type": "OBFUSCATED-1961643734",
      "X-Apple-OAuth-Redirect-URI": "OBFUSCATED-1866116011",
      "X-Apple-OAuth-Require-Grant-Code": "OBFUSCATED-4261170317",
      "X-Apple-OAuth-Response-Mode": "OBFUSCATED-1578278625",
      "X-Apple-OAuth-Response-Type": "OBFUSCATED-1997877400",
      "X-Apple-OAuth-State": "OBFUSCATED-1322006840",
      "X-Apple-Widget-Key": "OBFUSCATED-810530919",
      "scnt": "OBFUSCATED-1875386351",
      "X-Apple-ID-Session-Id": "OBFUSCATED-1939794523"
    },
    "cookies": {
      "dslang": "US-EN",
      "site": "USA",
      "aasp": "OBFUSCATED-2950245712"
    },
    "content": {
      "accountName": "OBFUSCATED-2149657519",
      "c": "OBFUSCATED-4023226760",
      "m1": "OBFUSCATED-2828148429",
      "m2": "OBFUSCATED-484427104",
      "rememberMe": true,
      "trustTokens": []
    }
  },
  "response": {
    "status_code": 401,
    "headers": {
      "Content-Type": "application/json;charset=UTF-8",
      "X-Apple-I-Request-ID": "OBFUSCATED-2172484804",
      "scnt": "OBFUSCATED-3131115259"
    },
    "cookies": {
      "dslang": "US-EN",
      "site": "USA"
    }
  }
}

[AndreyNikiforov]

Let me step back. Am I understand the issue correctly that you are providing a valid password, but icloudpd responds with "Invalid email/password combination" message? There is also a confusion about dumping JSON, but that is not the actual problem, right?

Re dumping JSON - that is a feature to help debugging auth errors. It dumps obfuscated request-responses for the whole auth flow if the flow fails. There is a bug that does not dump content of responses, making those dumps half-useful; I am fixing it in next release.

[lindenmj]

Yes, correct -- I am providing a valid password in both the CLI and the prompt in these cases. icloudpd works with one of my accounts but not the other.

The confusion with the JSON dump was that it was new to me and wasn't sure if that was a feature or a bug!

[AndreyNikiforov]

let's see if auth dumps from 1.32.2 give us more insights

[lindenmj]

Here's what I got after upgrading to 1.32.2. I'm guessing this is telling me the password is incorrect?

sudo icloudpd -u email@address -d "/directory/with/spaces/"  --cookie-directory /cookie/directory/ --set-exif-datetime --auto-delete --password-provider console

2025-09-02 11:35:23 INFO     Processing user: email@address
2025-09-02 11:35:23 DEBUG    Authenticating...
iCloud Password for email@address:
2025-09-02 11:35:30 INFO     ('Invalid email/password combination.', PyiCloudAPIResponseException('{\n  "serviceErrors" : [ {\n    "code" : "-20101",\n    "message" : "Check the account information you entered and try again.",\n    "suppressDismissal" : false\n  } ]\n} (401)'))
2025-09-02 11:35:30 DEBUG    {
  "request": {
    "method": "POST",
    "url": "https://idmsa.apple.com/appleauth/auth/signin/init",
    "headers": {
      "Origin": "https://idmsa.apple.com",
      "Referer": "https://idmsa.apple.com/",
      "Content-Type": "application/json",
      "X-Apple-OAuth-Client-Id": "OBFUSCATED-810530919",
      "X-Apple-OAuth-Client-Type": "OBFUSCATED-1961643734",
      "X-Apple-OAuth-Redirect-URI": "OBFUSCATED-1866116011",
      "X-Apple-OAuth-Require-Grant-Code": "OBFUSCATED-4261170317",
      "X-Apple-OAuth-Response-Mode": "OBFUSCATED-1578278625",
      "X-Apple-OAuth-Response-Type": "OBFUSCATED-1997877400",
      "X-Apple-OAuth-State": "OBFUSCATED-1322006840",
      "X-Apple-Widget-Key": "OBFUSCATED-810530919",
      "scnt": "OBFUSCATED-1235186569",
      "X-Apple-ID-Session-Id": "OBFUSCATED-789345663"
    },
    "cookies": {
      "dslang": "US-EN",
      "site": "USA",
      "aasp": "OBFUSCATED-789345663"
    },
    "content": {
      "a": "OBFUSCATED-560631373",
      "accountName": "OBFUSCATED-2149657519",
      "protocols": [
        "s2k",
        "s2k_fo"
      ]
    }
  },
  "response": {
    "status_code": 200,
    "headers": {
      "Content-Type": "application/json;charset=UTF-8",
      "X-Apple-I-Request-ID": "OBFUSCATED-1910403946",
      "scnt": "OBFUSCATED-2138760351"
    },
    "cookies": {
      "dslang": "US-EN",
      "site": "USA"
    },
    "content": {
      "iteration": 20512,
      "salt": "OBFUSCATED-3711388925",
      "protocol": "s2k",
      "b": "OBFUSCATED-2555126264",
      "c": "OBFUSCATED-684096647"
    }
  }
}
2025-09-02 11:35:30 DEBUG    {
  "request": {
    "method": "POST",
    "url": "https://idmsa.apple.com/appleauth/auth/signin/complete?isRememberMeEnabled=true",
    "headers": {
      "Origin": "https://idmsa.apple.com",
      "Referer": "https://idmsa.apple.com/",
      "Content-Type": "application/json",
      "X-Apple-OAuth-Client-Id": "OBFUSCATED-810530919",
      "X-Apple-OAuth-Client-Type": "OBFUSCATED-1961643734",
      "X-Apple-OAuth-Redirect-URI": "OBFUSCATED-1866116011",
      "X-Apple-OAuth-Require-Grant-Code": "OBFUSCATED-4261170317",
      "X-Apple-OAuth-Response-Mode": "OBFUSCATED-1578278625",
      "X-Apple-OAuth-Response-Type": "OBFUSCATED-1997877400",
      "X-Apple-OAuth-State": "OBFUSCATED-1322006840",
      "X-Apple-Widget-Key": "OBFUSCATED-810530919",
      "scnt": "OBFUSCATED-1235186569",
      "X-Apple-ID-Session-Id": "OBFUSCATED-789345663"
    },
    "cookies": {
      "dslang": "US-EN",
      "site": "USA",
      "aasp": "OBFUSCATED-789345663"
    },
    "content": {
      "accountName": "OBFUSCATED-2149657519",
      "c": "OBFUSCATED-684096647",
      "m1": "OBFUSCATED-699417087",
      "m2": "OBFUSCATED-3735179863",
      "rememberMe": true,
      "trustTokens": []
    }
  },
  "response": {
    "status_code": 401,
    "headers": {
      "Content-Type": "application/json;charset=UTF-8",
      "X-Apple-I-Request-ID": "OBFUSCATED-3168410995",
      "scnt": "OBFUSCATED-724937356"
    },
    "cookies": {
      "dslang": "US-EN",
      "site": "USA"
    },
    "content": {
      "serviceErrors": [
        {
          "code": "-20101",
          "message": "Check the account information you entered and try again.",
          "suppressDismissal": false
        }
      ]
    }
  }
}

[pcheng17]

I seem to also be hitting this issue. I've verified that the password I'm using is correct by logging into iCloud in the browser...

[opswhisperer]

Please tell me ChatGPT is wrong - only #3 makes sense to me

---

What your logs actually show — and why this account fails while the other works

Your logs make one thing clear: Apple isn’t rejecting your password. It’s rejecting the entire authentication method that icloudpd uses for this specific Apple ID.

---

What your logs actually say

Every attempt ends with:

Invalid email/password combination. (-20283)

Right before that, you always see:

Authentication required for Account. (421)

Then icloudpd tries:

Starting web server for WebUI authentication

And Apple immediately rejects the request again with -20283.

This happens repeatedly across multiple timestamps.

---

The key detail:
Apple is blocking the legacy authentication endpoint

Your logs show requests to:

https://setup.icloud.com/setup/ws/1/validate

This is the old iCloud login API.
Apple is shutting this down on a per-account basis.

Your other iCloud user still works because Apple hasn’t migrated that Apple ID yet.
This account has been migrated or flagged, so the old API is dead for that account.

---

Why the app-specific password didn’t help

App-specific passwords only work AFTER Apple accepts the initial login.
Your login is failing BEFORE that stage, so the app-specific password is never even used.

---

The smoking gun in your logs

You have headers like:

X-Apple-OAuth-Client-Id

This means Apple is telling icloudpd:

“Use the new OAuth flow, not the old Web Services flow.”

icloudpd does NOT support the new OAuth-based login.
That’s why this specific account fails while the other one still works.

---

What triggers this?

1. Advanced Data Protection enabled
   If ADP is turned on, all third-party iCloud API access is blocked.
   Check:
   Settings → Apple ID → iCloud → Advanced Data Protection
   If it’s on: turn it off and try again after 1–2 hours.

2. A recent security event on the account
   Examples:

   • password changed
   • new device login
   • login from a new IP or location
   • account lock/unlock
     Apple puts the account in “hardened auth mode” for 24–72 hours.

** 3. Apple migrated this Apple ID to the new auth system
They’re rolling this out selectively.
Once migrated, icloudpd will NEVER work for that account unless the tool adds OAuth support.**

4. Using an alias instead of the primary Apple ID
   Must use the primary Apple ID email found under:
   Settings → Apple ID → Name, Phone Numbers, Email

[quackitiy]

Are there plans to fix this? I ran into this today and am behind on downloading stuff to my SSD from icloud. :(

[opswhisperer]

seems this project is dead, there haven't been any updates unfortunately in months

[b0ink]

Experienced the same issue because of a recent password change, I used --password-provider console which was able to prompt me for my new password but i still received the same error (didnt get to 2FA)

However, I was able to re-authenticate using version icloudpd-ex-1.27.0-windows-amd64.exe (last downloaded version i was previously using) and signed in with 2FA and it started downloading my photos. I then tried icloudpd-1.32.2-windows-amd64.exe and since i was now authenticated it worked like normal.

[lindenmj]

After this last message I tried the broken login again, and it worked! Here's what's happened between then and now:

• I went through a full, clean OS reinstall (Ubuntu Server 24.04.3) a couple months ago
• I may or may not have deleted the cookies that were associated (and saved) for the broken account
• I got a new iPhone for the user

So I'm not sure what I did to fix it, or maybe I didn't do anything and Apple changed something.

I'm on the latest as of today, 1.32.2 build date Sep 1, 2025.