Remove DEVELOPER_ID_APPLICATION_G2 certificate type

[priitlatt]

Starting from 05.06.25 App Store Connect API has removed support for DEVELOPER_ID_APPLICATION_G2 certificate type despite it still being listed as a valid value for CertificateType (as of 06.06.25).

This causes requests to GET https://api.appstoreconnect.apple.com/v1/certificates fail if filter[certificateType] query parameter contains value DEVELOPER_ID_APPLICATION_G2. Server responds with status code 400 and error payload

{
    "errors": [
        {
            "id": "9b255f99-cf4b-4d43-9722-30a688964035",
            "status": "400",
            "code": "PARAMETER_ERROR.INVALID",
            "title": "A parameter has an invalid value",
            "detail": "'DEVELOPER_ID_APPLICATION_G2' is not a valid filter value. Expected one of: APPLE_PAY, APPLE_PAY_MERCHANT_IDENTITY, APPLE_PAY_PSP_IDENTITY, APPLE_PAY_RSA, DEVELOPER_ID_KEXT, DEVELOPER_ID_APPLICATION, DEVELOPMENT, DISTRIBUTION, IDENTITY_ACCESS, IOS_DEVELOPMENT, IOS_DISTRIBUTION, MAC_APP_DISTRIBUTION, MAC_INSTALLER_DISTRIBUTION, MAC_APP_DEVELOPMENT, PASS_TYPE_ID, PASS_TYPE_ID_WITH_NFC",
            "source": {
                "parameter": "filter[certificateType]"
            }
        }
    ]
}

Full command log

9:58:02 priit@marmot ~ app-store-connect certificates list --type DEVELOPER_ID_APPLICATION_G2 --log-api-calls
>>> GET https://api.appstoreconnect.apple.com/v1/certificates {'limit': 100, 'sort': 'displayName', 'filter[certificateType]': 'DEVELOPER_ID_APPLICATION_G2'}
<<< 400 {'errors': [{'id': 'e623996a-2c1f-4c42-b192-414fd0d01926', 'status': '400', 'code': 'PARAMETER_ERROR.INVALID', 'title': 'A parameter has an invalid value', 'detail': "'DEVELOPER_ID_APPLICATION_G2' is not a valid filter value. Expected one of: APPLE_PAY, APPLE_PAY_MERCHANT_IDENTITY, APPLE_PAY_PSP_IDENTITY, APPLE_PAY_RSA, DEVELOPER_ID_KEXT, DEVELOPER_ID_APPLICATION, DEVELOPMENT, DISTRIBUTION, IDENTITY_ACCESS, IOS_DEVELOPMENT, IOS_DISTRIBUTION, MAC_APP_DISTRIBUTION, MAC_INSTALLER_DISTRIBUTION, MAC_APP_DEVELOPMENT, PASS_TYPE_ID, PASS_TYPE_ID_WITH_NFC", 'source': {'parameter': 'filter[certificateType]'}}]}
GET https://api.appstoreconnect.apple.com/v1/certificates?limit=100&sort=displayName&filter%5BcertificateType%5D=DEVELOPER_ID_APPLICATION_G2 returned 400: A parameter has an invalid value - 'DEVELOPER_ID_APPLICATION_G2' is not a valid filter value. Expected one of: APPLE_PAY, APPLE_PAY_MERCHANT_IDENTITY, APPLE_PAY_PSP_IDENTITY, APPLE_PAY_RSA, DEVELOPER_ID_KEXT, DEVELOPER_ID_APPLICATION, DEVELOPMENT, DISTRIBUTION, IDENTITY_ACCESS, IOS_DEVELOPMENT, IOS_DISTRIBUTION, MAC_APP_DISTRIBUTION, MAC_INSTALLER_DISTRIBUTION, MAC_APP_DEVELOPMENT, PASS_TYPE_ID, PASS_TYPE_ID_WITH_NFC

Remove usages of DEVELOPER_ID_APPLICATION_G2 certificate type to overcome those errors. When resolving certificate type for given provisioning profile type, only DEVELOPER_ID_APPLICATION certificate type will be used now for profile types MAC_APP_DIRECT and MAC_CATALYST_APP_DIRECT.

Updated actions:

• app-store-connect fetch-signing-files
• app-store-connect certificates create
• app-store-connect certificates list

[fran-tirapu]

[envictor]

Question:
On my machine, which has an outdated (0.55.0) version of codemagic-cli-tools, I can successfully fetch my certificate and 2 profiles, and this certificate is of type G2.

While on Codemagic's VMs, which have 0.67.0, it fails to fetch my certificate (it finds a different one) and no profiles.

If it works with the old version, does this mean that Apple fixed the Appstore Connect API and it now accepts DEVELOPER_ID_APPLICATION_G2?

Update:
I went ahead and run @priitlatt's example command, and it returns successfully now. So I think this change should probably be reverted, so that we can work with certificates generated recently.

[envictor]

Do let me know if you prefer me to create a full new issue for this

[priitlatt]

Hi @envictor! Thanks for letting us know about it. Apple has now even included DEVELOPER_ID_APPLICATION_G2 as a valid certificate type in their documentation, see https://developer.apple.com/documentation/appstoreconnectapi/certificatetype.

Restoring support for it should be fairly straightforward and I hope to get it done soon. There is no need for separate issue.

[priitlatt]

@envictor, support for DEVELOPER_ID_APPLICATION_G2 was restored in PR #498 and released in version 0.68.0.

[envictor]

Appreciate the quick turnaround time, @priitlatt . Thanks so much!