Apple 2FA SMS code rejected (“Invalid code”) when logging in via EAS CLI on Windows — code works in browser

[Harsh1032]

Build/Submit details page URL

No response

Summary

When running eas build --platform ios --profile production, EAS prompts for Apple Developer login. Apple ID + password succeeds, but the 6-digit 2FA code sent via SMS is consistently rejected as “Invalid code”. The same account/code works when signing in via the Apple website/browser. This started happening since last Thursday previously working for months with the same account and EAS workflow.

Managed or bare?

Managed

Environment

expo-env-info 2.0.8 environment info:
System:
OS: Windows 11 10.0.26200
Binaries:
Node: 22.14.0
npm: 10.9.2
IDEs:
Android Studio: AI-243.24978.46.2431.13208083
npmPackages:
expo: ^54.0.7 => 54.0.21
expo-router: ~6.0.4 => 6.0.14
expo-updates: ~29.0.10 => 29.0.12
react: 19.1.0
react-dom: 19.1.0
react-native: 0.81.4
react-native-web: 0.21.2
Expo Workflow: managed

Error output

EXPO_DEBUG=true
Command: eas build --platform ios --profile production

... Apple ID accepted ...
... password accepted ...
Two-factor Authentication enabled
Please enter the 6 digit code you received at +971…10
Entered correct code
✖ Invalid code
(re-prompts for 2FA)

Reproducible demo or steps to reproduce from a blank project

Repro steps (blank project):

1. npx create-expo-app@latest repro-apple-2fa
2. cd repro-apple-2fa
3. eas init
4. eas build --platform ios --profile production
5. When prompted, log in to Apple Developer account
6. Enter Apple ID + password (works)
7. Enter 6-digit 2FA code received via SMS (rejected with “Invalid code”)

Notes:

• The same Apple ID/2FA code works when signing in via Apple website/browser.
• This started since last Thursday; we have already completed ~94 EAS iOS builds successfully before this regression using the same client-owned Apple Developer Organization account.

[manuelduarte077]

I’m also running into similar 2FA issues when using EAS CLI for Apple login.
In my case, the 6-digit SMS code is consistently rejected as “Invalid code” by the CLI, even though the same code works when signing in through Apple’s website/browser.

This seems related to other Apple Developer authentication issues reported recently — e.g., in issue #2698 and #3308 — where the authentication flow fails in EAS CLI but works externally.

For reference: #2698

It would help to know if this is due to changes in Apple’s 2FA API behavior or something specific to the Windows CLI login flow. I’ve also confirmed this started happening only recently after previously working fine.