Just in case someone is still asking this question (as I did): I was able to use notarytool (newer alternative to altool) authenticated via App Store Connect API key with only Developer role granted.