App Store Server API: Sandbox returns 200, Production returns 401 with the same JWT
We are seeing a reproducible authentication issue with the App Store Server API for our app FYRT.
Bundle ID: com.fyrt.Fyrt
We performed a fresh read-only test on September 29, 2026 using our In-App Purchase key BJ5HR5GSY6.
Both requests used:
- the same In-App Purchase key
- the same Issuer ID
- the same Bundle ID
- ES256
- the same JWT structure
- 300-second token lifetime
- correct system time with no relevant clock skew
Only the environment changed.
Sandbox:
- HTTP 200
- Apple Request ID: 458b3b32-8e0d-1404-19fe-6c92ba2ccd27
Production:
- HTTP 401
- Apple Request ID: 193406ac-80d2-d135-8cc8-34e4ebe76fc5
The Production response does not include an additional Apple error code.
The request is read-only and requests notification history. No purchase is triggered and no Production data is changed.
We verified:
- correct Key ID
- correct Issuer ID
- correct Bundle ID
- ES256 signing
- current iat
- valid exp
- correct Sandbox and Production endpoints
- no environment mixing
- fresh JWT generation for each request
- no clock skew
The same behavior was already reproduced on September 11, 2026.
Our existing Apple Support case is: 102960057430
Has anyone seen Sandbox accept the same authentication while Production returns 401?
Could this be related to Production-side provisioning, app status, team/account authorization, or the fact that the app has not yet had a version released on the App Store?
Any guidance from Apple engineers would be greatly appreciated.