srp issue with login

[plk]

The problem

Authentication isn't working for me with username/password - this has been on and off an issue for years but lately, it just won't work. I get:

pyicloud.exceptions.PyiCloudFailedLoginException: Invalid email/password combination.

from _srp_authentication. Using the same email/password to log in via a browser works fine.

Environment

• pyiCloud release with the issue (pip show pyicloud): 2.2.1.dev15+gcfb15f89d
• Last working pyiCloud release (if known):
• Service causing this issue: authentication
• Python version (python -V): 3.12.0
• Operating environment (project deps/Docker/Windows/etc.): MacOS

Traceback/Error logs

Checklist

• [ x] I've looked informations into the README.
• [x ] I've looked informations into the pyiCloud's code.
• [ x] I've looked information on Google.

Additional information

[coderabbitai]

📝 CodeRabbit Plan Mode

Generate an implementation plan and prompts that you can use with your favorite coding agent.

• Create Plan

Examples

• Example 1
• Example 2

---

🔗 Similar Issues

Possible Duplicates

• Incomplete SRP protocol implementation, missing s2k_fo #156

Related Issues

• pyicloud.exceptions.PyiCloudAPIResponseException: Authentication required for Account. (450) #131
• Bug with icloud accounts without 2FA #137
• RuntimeError: Failed to access devices: ('Failed to initiate srp authentication.', PyiCloudAPIResponseException('Service Temporarily Unavailable (503)')) #146
• pyicloud.exceptions.PyiCloudAPIResponseException: Unauthorized (401) #81

👤 Suggested Assignees

• Epik77
• steffenmartin
• persikrgt
• Axoled-Student
• vptimmy

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[timlaing]

Thank for you feedback. I'll take a look at this issue for you.

[plk]

Much appreciated.

[timlaing]

Are you able to run this code, and let me know the result, and response. Thanks.

import http.client
import logging
import sys
import click
from pyicloud import PyiCloudService

logging.basicConfig(level=logging.DEBUG)
http.client.HTTPConnection.debuglevel = 1

api = PyiCloudService("myUserName@icloud.com", "myPassword", cookie_directory=".")
if api.requires_2fa:
    security_key_names = api.security_key_names

    if security_key_names:
        print(
            f"Security key confirmation is required. "
            f"Please plug in one of the following keys: {', '.join(security_key_names)}"
        )

        devices = api.fido2_devices

        print("Available FIDO2 devices:")

        for idx, dev in enumerate(devices, start=1):
            print(f"{idx}: {dev}")

        choice = click.prompt(
            "Select a FIDO2 device by number",
            type=click.IntRange(1, len(devices)),
            default=1,
        )
        selected_device = devices[choice - 1]

        print("Please confirm the action using the security key")

        api.confirm_security_key(selected_device)

    else:
        print("Two-factor authentication required.")
        code = input("Enter the code you received of one of your approved devices: ")
        print(code)
        result = api.validate_2fa_code(code)
        print("Code validation result: %s" % result)

        if not result:
            print("Failed to verify security code")
            sys.exit(1)

    if not api.is_trusted_session:
        print("Session is not trusted. Requesting trust...")
        result = api.trust_session()
        print("Session trust result %s" % result)

        if not result:
            print(
                "Failed to request trust. You will likely be prompted for confirmation again in the coming weeks"
            )

elif api.requires_2sa:
    print("Two-step authentication required. Your trusted devices are:")

    devices = api.trusted_devices
    for i, device in enumerate(devices):
        print(
            "  %s: %s"
            % (i, device.get("deviceName", "SMS to %s" % device.get("phoneNumber")))
        )

    device = click.prompt("Which device would you like to use?", default=0)
    device = devices[device]
    if not api.send_verification_code(device):
        print("Failed to send verification code")
        sys.exit(1)

    code = click.prompt("Please enter validation code")
    if not api.validate_verification_code(device, code):
        print("Failed to verify verification code")
        sys.exit(1)

print(api.iphone.data)

[plk]

I anonymised the login:

DEBUG:pyicloud.session:Using session file ./abc.session
INFO:pyicloud.session:Session file does not exist
DEBUG:pyicloud.base:Authenticating as a@b.com
DEBUG:pyicloud.session:POST https://idmsa.apple.com/appleauth/auth/signin/init
DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): idmsa.apple.com:443
send: b'POST /appleauth/auth/signin/init HTTP/1.1\r\nHost: idmsa.apple.com\r\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Safari/605.1.15\r\nAccept-Encoding: gzip, deflate\r\nAccept: application/json, text/javascript\r\nConnection: keep-alive\r\nOrigin: https://www.icloud.com\r\nReferer: https://www.icloud.com/\r\nContent-Type: application/json\r\nX-Apple-OAuth-Client-Id: d39ba9916b7251055b22c7f910e2ea796ee65e98b2ddecea8f5dde8d9d1a815d\r\nX-Apple-OAuth-Client-Type: firstPartyAuth\r\nX-Apple-OAuth-Redirect-URI: https://www.icloud.com\r\nX-Apple-OAuth-Require-Grant-Code: true\r\nX-Apple-OAuth-Response-Mode: web_message\r\nX-Apple-OAuth-Response-Type: code\r\nX-Apple-OAuth-State: auth-8e2db2aa-e807-11f0-80ba-661780c54b09\r\nX-Apple-Widget-Key: d39ba9916b7251055b22c7f910e2ea796ee65e98b2ddecea8f5dde8d9d1a815d\r\nContent-Length: 422\r\n\r\n'
send: b'{"a": "lfGvgA7F4iAc6uVFwdhHeRoSRCwdXLBWqCfLkmzKm/dCxBVwqpAz5PQASf9CyNUn+Flh3qGbuOyDecHytbYSoMyjsVuQYGnPbxSuqR2BDE/HZg8ubBP/8aU/2i30dZ7LIfGKzVpBmXIw97Okx34asG1PimLSlF/KTbLtpiV7dWR8Kt7WG/UjtJXgPuYdxmnAas7DV76mvCul5nDuCv1+VapGF0cp8u6a2ZyzvTQUz01i2uR4rAO02JHQ+OyOtR4T+obdzUaL2KhxyyQx89/zs9nraiHwcyPSnxxTCxJdWAesPcK9wEgoCRViOFagV0ZOTjsNpDFXcaIX0ljo42vbMw==", "accountName": "a@b.com", "protocols": ["s2k", "s2k_fo"]}'
reply: 'HTTP/1.1 200 \r\n'
header: Server: Apple
header: Date: Fri, 02 Jan 2026 18:19:20 GMT
header: Content-Type: application/json;charset=UTF-8
header: Transfer-Encoding: chunked
header: Connection: keep-alive
header: X-Apple-I-Request-ID: 8e832659-e807-11f0-83c0-0586c7c49900
header: X-FRAME-OPTIONS: DENY
header: X-Content-Type-Options: nosniff
header: X-XSS-Protection: 1; mode=block
header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
header: Content-Security-Policy: default-src 'self' ; child-src blob: ; connect-src 'self' https://www.apple.com https://appleid.cdn-apple.com https://webcourier.sandbox.push.apple.com https://xp-qa.apple.com wss://websocket.push.apple.com ; font-src 'self' https://www.apple.com https://appleid.cdn-apple.com https://idmsa.apple.com https://gsa.apple.com https://idmsa.apple.com.cn https://signin.apple.com ; frame-src 'self' https://appleid.apple.com https://gsa.apple.com https://account.apple.com ; img-src 'self' https://www.apple.com https://appleid.cdn-apple.com https://*.mzstatic.com data: https://*.apple.com ; media-src data: ; object-src 'none' ; script-src 'self' https://www.apple.com https://appleid.cdn-apple.com https://idmsa.apple.com https://gsa.apple.com https://idmsa.apple.com.cn https://signin.apple.com ; style-src 'unsafe-inline' 'self' https://www.apple.com https://appleid.cdn-apple.com https://idmsa.apple.com https://gsa.apple.com https://idmsa.apple.com.cn https://signin.apple.com ;
header: Referrer-Policy: origin
header: X-BuildVersion: R3
header: scnt: AAAA-jg4QzVDOTNBNDZFMjdERDRBMDI4ODBBQjEyOTI0M0YwRjI4M0U2OTMyQjgzRDlGNUJFREI1MUVENzIxNTVEMkIzQzI4RDQ0QTIzMEJGQTZDMzg5MjYxM0MzNjNGQkFFQkUxQjgyNjIxODQxQTYwMEJCRUQ2QjY4RkYyMzQ2MkZCNEQ2MkNBNzM1QkFDRTg4RjQxQkZCMjIzNDYxQjM1QkY4QTBEQjQ1NDA3RDUyOTY4M0E5ODc3NkY5NjRERUExRjg3MjVCQzEzODZDQjVFQ0U1NEJGMDY3OTdGNThFQjYyNzEwQzc0M0JCQTg4NTFDNHwxAAABm3_9OJt29s-WuhwpGwEShoKNcw6Hz4UAZeOIEfRVsHcpMfEbbBxZc9-gL-siAA948d_pTeTPcmNjSdI0pRS8SuBWCsWtXgYLVcrNif6zC1VTgZV2Jw
header: Set-Cookie: dslang=US-EN; Domain=apple.com; Path=/; Secure; HttpOnly
header: Set-Cookie: site=USA; Domain=apple.com; Path=/; Secure; HttpOnly
header: Cache-Control: no-store
header: Cache-Control: no-store
header: Set-Cookie: aasp=88C5C93A46E27DD4A02880AB129243F0F283E6932B83D9F5BEDB51ED72155D2B3C28D44A230BFA6C3892613C363FBAEBE1B82621841A600BBED6B68FF23462FB4D62CA735BACE88F41BFB223461B35BF8A0DB45407D529683A98776F964DEA1F8725BC1386CB5ECE54BF06797F58EB62710C743BBA8851C4; Domain=idmsa.apple.com; Path=/; Secure; HttpOnly
header: X-Apple-ID-Session-Id: 88C5C93A46E27DD4A02880AB129243F0F283E6932B83D9F5BEDB51ED72155D2B3C28D44A230BFA6C3892613C363FBAEBE1B82621841A600BBED6B68FF23462FB4D62CA735BACE88F41BFB223461B35BF8A0DB45407D529683A98776F964DEA1F8725BC1386CB5ECE54BF06797F58EB62710C743BBA8851C4
header: vary: accept-encoding
header: Content-Encoding: gzip
header: Content-Language: en-US-x-lvariant-USA
DEBUG:urllib3.connectionpool:https://idmsa.apple.com:443 "POST /appleauth/auth/signin/init HTTP/1.1" 200 None
DEBUG:pyicloud.session:Saved session data to file: ./abc.session
DEBUG:pyicloud.session:Saved cookies data to file: ./abc.cookiejar
DEBUG:pyicloud.session:POST https://idmsa.apple.com/appleauth/auth/signin/complete
send: b'POST /appleauth/auth/signin/complete?isRememberMeEnabled=true HTTP/1.1\r\nHost: idmsa.apple.com\r\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Safari/605.1.15\r\nAccept-Encoding: gzip, deflate\r\nAccept: application/json, text/javascript\r\nConnection: keep-alive\r\nOrigin: https://www.icloud.com\r\nReferer: https://www.icloud.com/\r\nContent-Type: application/json\r\nX-Apple-OAuth-Client-Id: d39ba9916b7251055b22c7f910e2ea796ee65e98b2ddecea8f5dde8d9d1a815d\r\nX-Apple-OAuth-Client-Type: firstPartyAuth\r\nX-Apple-OAuth-Redirect-URI: https://www.icloud.com\r\nX-Apple-OAuth-Require-Grant-Code: true\r\nX-Apple-OAuth-Response-Mode: web_message\r\nX-Apple-OAuth-Response-Type: code\r\nX-Apple-OAuth-State: auth-8e2db2aa-e807-11f0-80ba-661780c54b09\r\nX-Apple-Widget-Key: d39ba9916b7251055b22c7f910e2ea796ee65e98b2ddecea8f5dde8d9d1a815d\r\nCookie: dslang=US-EN; site=USA; aasp=88C5C93A46E27DD4A02880AB129243F0F283E6932B83D9F5BEDB51ED72155D2B3C28D44A230BFA6C3892613C363FBAEBE1B82621841A600BBED6B68FF23462FB4D62CA735BACE88F41BFB223461B35BF8A0DB45407D529683A98776F964DEA1F8725BC1386CB5ECE54BF06797F58EB62710C743BBA8851C4\r\nContent-Length: 238\r\n\r\n'
send: b'{"accountName": "a@b.com", "c": "d-7c6-8e898ed1-e807-11f0-aa9b-8bda25813f58:NC", "m1": "81ExgupFweiUtj3m+hb51Mj/w8DSQ/fsdsddQFeJ+MQ=", "m2": "r0XcXEJ5ucFPc9CbVmaarKyg/tiFuWt+5GXrBYW56O0=", "rememberMe": true, "trustTokens": []}'
reply: 'HTTP/1.1 401 \r\n'
header: Server: Apple
header: Date: Fri, 02 Jan 2026 18:19:20 GMT
header: Content-Type: application/json;charset=UTF-8
header: Transfer-Encoding: chunked
header: Connection: keep-alive
header: X-Apple-I-Request-ID: 8ea8af11-e807-11f0-b680-b5c6b796707d
header: X-FRAME-OPTIONS: DENY
header: X-Content-Type-Options: nosniff
header: X-XSS-Protection: 1; mode=block
header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
header: Content-Security-Policy: default-src 'self' ; child-src blob: ; connect-src 'self' https://www.apple.com https://appleid.cdn-apple.com https://webcourier.sandbox.push.apple.com https://xp-qa.apple.com wss://websocket.push.apple.com ; font-src 'self' https://www.apple.com https://appleid.cdn-apple.com https://idmsa.apple.com https://gsa.apple.com https://idmsa.apple.com.cn https://signin.apple.com ; frame-src 'self' https://appleid.apple.com https://gsa.apple.com https://account.apple.com ; img-src 'self' https://www.apple.com https://appleid.cdn-apple.com https://*.mzstatic.com data: https://*.apple.com ; media-src data: ; object-src 'none' ; script-src 'self' https://www.apple.com https://appleid.cdn-apple.com https://idmsa.apple.com https://gsa.apple.com https://idmsa.apple.com.cn https://signin.apple.com ; style-src 'unsafe-inline' 'self' https://www.apple.com https://appleid.cdn-apple.com https://idmsa.apple.com https://gsa.apple.com https://idmsa.apple.com.cn https://signin.apple.com ;
header: Referrer-Policy: origin
header: X-BuildVersion: R3
header: scnt: AAAA-jg4QzVDOTNBNDZFMjdERDRBMDI4ODBBQjEyOTI0M0YwRjI4M0U2OTMyQjgzRDlGNUJFREI1MUVENzIxNTVEMkIzQzI4RDQ0QTIzMEJGQTZDMzg5MjYxM0MzNjNGQkFFQkUxQjgyNjIxODQxQTYwMEJCRUQ2QjY4RkYyMzQ2MkZCNEQ2MkNBNzM1QkFDRTg4RjQxQkZCMjIzNDYxQjM1QkY4QTBEQjQ1NDA3RDUyOTY4M0E5ODc3NkY5NjRERUExRjg3MjVCQzEzODZDQjVFQ0U1NEJGMDY3OTdGNThFQjYyNzEwQzc0M0JCQTg4NTFDNHwyAAABm3_9OZn2hYIMa7Qo7_PQ3uzDhkkXtP1nbkVJQel4d1WY0M0VO_9Mieq3UBg-AA3wuPUAagD435UrOvMPdlz9mbBW_aATKQl3svEcUe8JMhMcVEikTg
header: Set-Cookie: dslang=US-EN; Domain=apple.com; Path=/; Secure; HttpOnly
header: Set-Cookie: site=USA; Domain=apple.com; Path=/; Secure; HttpOnly
header: Cache-Control: no-store
header: Cache-Control: no-store
header: vary: accept-encoding
header: Content-Encoding: gzip
header: Content-Language: en-US-x-lvariant-USA
DEBUG:urllib3.connectionpool:https://idmsa.apple.com:443 "POST /appleauth/auth/signin/complete?isRememberMeEnabled=true HTTP/1.1" 401 None
DEBUG:pyicloud.session:Saved session data to file: ./abc.session
DEBUG:pyicloud.session:Saved cookies data to file: ./abc.cookiejar
Traceback (most recent call last):
  File "/Users/philkime/.pyenv/versions/3.12.0/lib/python3.12/site-packages/pyicloud/base.py", line 278, in _authenticate
    self._authenticate_with_token()
  File "/Users/philkime/.pyenv/versions/3.12.0/lib/python3.12/site-packages/pyicloud/base.py", line 363, in _authenticate_with_token
    raise PyiCloudFailedLoginException("No session token available")
pyicloud.exceptions.PyiCloudFailedLoginException: No session token available

[timlaing]

Hi @plk, are you able to use the latest version of the source code. pip install 'git+https://github.com/timlaing/pyicloud'. As the stack trace matches 2.2.0, a related issue has been address in this version which I will be relasing as soon as I can.

[plk]

This installed version 'pyicloud-2.2.1.dev15+gcfb15f89d' but gives the same error ...

[timlaing]

@plk - I'll have another look at this for you.

[plk]

Any news?

[timlaing]

Closing issue as stale.