Electron notarize "Invalid credentials" (Apple notarization) in CI

By Daniel Zoghalchali·Latchkey

Apple notarization uploads the signed app and authenticates with either an Apple ID plus app-specific password or an App Store Connect API key. A 401 "Invalid credentials" means those values are missing, wrong, or lack the right team.

What this error means

The notarize step fails with "Error: HTTP status code: 401. Invalid credentials. Username or password is incorrect" or notarytool "Unable to authenticate".

electron-builder

  ⨯ Failed to notarize
Error: HTTP status code: 401. Invalid credentials. Username or password
is incorrect. Use the app-specific password generated at appleid.apple.com

Common causes

Wrong or missing Apple ID credentials

APPLE_ID / APPLE_APP_SPECIFIC_PASSWORD are unset or hold a regular account password instead of an app-specific one.

API key fields not all provided

Using an App Store Connect key requires the key id, issuer id, and .p8 together; omitting one yields a 401.

How to fix it

Supply an app-specific password

Generate an app-specific password at appleid.apple.com and pass it with the Apple ID and team id as secrets.

.github/workflows/ci.yml

env:
  APPLE_ID: ${{ secrets.APPLE_ID }}
  APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_PWD }}
  APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}

Or use an App Store Connect API key

Provide all three key fields so notarytool can authenticate without an Apple ID.

.github/workflows/ci.yml

env:
  APPLE_API_KEY: ${{ secrets.ASC_KEY_P8_PATH }}
  APPLE_API_KEY_ID: ${{ secrets.ASC_KEY_ID }}
  APPLE_API_ISSUER: ${{ secrets.ASC_ISSUER_ID }}

How to prevent it

Use an app-specific password, never the plain Apple ID password.
Provide all three API key fields together when using a key.
Confirm the team id matches the signing certificate.

Frequently asked questions

What causes ""Invalid credentials" (notarize)"?