Hi, I’m trying to access my own iCloud Contacts via CardDAV from a self-hosted web application. Apple’s documentation still states that app-specific passwords can be used for third-party access to iCloud Contacts when the app does not support Apple’s newer authorization flow. However, authentication currently fails consistently with HTTP 401 at the very first CardDAV request. Setup: Apple Account with 2FA enabled correct Apple Account ID / iCloud address freshly generated app-specific password CardDAV endpoint: https://contacts.icloud.com/ HTTP Basic Auth read-only PROPFIND requesting current-user-principal I have reproduced the same result with three independent clients: my own PHP/libcurl implementation a minimal direct cURL/libcurl reference request vdirsyncer 0.21.0 vdirsyncer fails during discovery with: 401 Unauthorized https://contacts.icloud.com/.well-known/carddav In my direct request, Basic Authorization is definitely sent and the server responds 401 before any redirect or personal CardDAV shard discovery occurs. I have also verified: no username mismatch no redirect/auth-header loss no HTTP/1.1 vs HTTP/2 issue no password transformation by the application a fresh app-specific password was copied directly from Apple and tested immediately Interestingly, direct CardDAV access for this same project/account worked previously, so CardDAV itself has worked for this account before. Has anything changed recently regarding authentication to iCloud Contacts/CardDAV? Specifically: Are app-specific passwords still expected to authenticate directly against contacts.icloud.com? Is there any additional account setting or authorization required now? Is .well-known/carddav still the supported discovery route? Is Apple’s newer “Account Data Sharing” authorization available to independent/self-hosted applications for iCloud Contacts, and if so, is there developer documentation for that flow? I’m deliberately not asking about writing contacts yet — this is only a read-only CardDAV authentication/discovery test. Thanks for any pointers. Cheers, Vince