It's not immediately obvious, the but those URLs need to be signed. This is a fairly complex process. There's a beta (at time of writing) library called app-store-server-library that's in different languages like Python, Swift, etc. Check out the WWDC23 session on Meet The App Store Server Library, where they cover it in depth. You'll need to create keys and certificates, etc, to get the library working (and would have to do the same plus manual signing if you were to use something like curl to make the requests).

Did you ever get to the bottom of this?

If anyone runs into this or similar issues, make sure your code handles the optional view controller that is vended as part of the Game Center authorization flow. The documentation mentions this – even though that VC may be nil in the dev/sandbox environment, that's not a guarantee that you can ignore it. Not 100% sure this was my issue, but by implementing code to present the VC if present, I no longer had issues with Game Center auth on production. I also never see the VC show up, but it's possible that it happens instantaneously – performing some additional work before closing immediately. Tl;dr: make sure you handle the optional VC vended by the Game Center auth methods.

Thanks for that resource — more of a simulator limitation than a "bug". Out of curiosity I might try this in a native macOS app rather than simulator — I have a feeling it would work in that context. Either way, this unblocked me and I'm now using the depth buffer to control my post-process effects, thanks!