Team ID: CDLWFYN589 Bundle IDs affected: br.com.cesto, br.com.cestoparceiros App IDs created: 2026-08-20 (both recreated on that date) Build: TestFlight, iOS 26, physical iPhone Related: Developer Forums thread 837986 (same signature), FB24029082, FB24554959 SUMMARY Every first-time Sign in with Apple authorization fails with "Sign Up Not Completed". The Apple sheet renders correctly with the app name and the user's account, the user authorizes, and the failure happens after consent, in the SRP exchange with the Apple ID server. Our backend is never reached — signInAsync never returns a credential. DEVICE LOG (akd, 2026-09-05 17:21:06-13, UTC-3) Client has default access level in SiwA entitlement Fetching developer team for client with ID: Encountered error while fetching developer team: Error Domain=AKSQLError Code=-6003 No applications were found with the provided Client ID: Application has no shared credentials Using personal credential state - 2, error - Error Domain=AKAuthenticationError Code=-7074 presenting authorization UI for request <- sheet appears Got a response from user <- user authorizes No password, but CK is available. Will ask for ck-based auth. Task <59764A72-...> received response, status 200 AppleIDAuthSupport: setError: 2:M2 missing (bad password) Invalid/missing value for key acname: (null) Invalid value for key ut: (null) Invalid value for key authType: (null) SRP authentication with server failed! Error Domain=com.apple.AppleIDAuthSupport Code=2 The server returns HTTP 200 with the server proof (M2) absent. The "bad password" string is the generic label for error 2 — there is no password in this exchange, as the preceding line shows (No password, but CK is available). WHAT WE HAVE ALREADY VERIFIED ON OUR SIDE Capability APPLE_ID_AUTH present on both App IDs, with APPLE_ID_AUTH_APP_CONSENT: PRIMARY_APP_CONSENT (App Store Connect API). com.apple.developer.applesignin: [Default] present in the shipped .ipa (codesign -d --entitlements :- on the extracted payload, not the archive). Embedded profile is "iOS Team Store Provisioning Profile" and carries the entitlement (security cms -D -i embedded.mobileprovision). Bundle IDs match across app.json, Identifiers and App Store Connect. No other App ID in the team declares APPLE_ID_AUTH. Program License Agreement accepted (2026-08-25); 2FA active on the account. The device log line "Client has default access level in SiwA entitlement" confirms the entitlement is read correctly on device. Requesting only fullName (no email scope) does not change the outcome. EXPECTED First-time authorization completes and returns an authorization code / identity token to the app. ACTUAL "Sign Up Not Completed", with the SRP failure above. 100% reproducible, on every attempt, for every one of our App IDs.