Hi all, and particularly @Eskimo if you spot this — I believe I'm reproducing the backend issuance bug reported in thread 816377 (https://developer.apple.com/forums/thread/816377) on a different Team ID and would like a second pair of eyes before I burn a TSI. Feedback Assistant filed as FB22582333.
Team ID: MCN4U9B2K4 · Bundle ID: com.michaeltocco.Sanbox · Xcode 17 · iOS 18.5 · Automatic signing
Setup
- App ID com.michaeltocco.Sanbox has ShazamKit ticked in App Services; persists through portal reloads.
- Local entitlements file declares com.apple.developer.shazamkit = YES only (no MusicKit client entitlement, per DTS guidance in thread 799000: https://developer.apple.com/forums/thread/799000).
- CODE_SIGN_ENTITLEMENTS set in both Debug and Release XCBuildConfiguration buildSettings.
- NSMicrophoneUsageDescription and NSAppleMusicUsageDescription are both present in the generated Info.plist.
What Xcode reports
After wiping DerivedData and any Sanbox-matching profiles and running xcodebuild … -allowProvisioningUpdates -destination 'generic/platform=iOS':
error: Entitlement com.apple.developer.shazamkit not found and could not be included in profile.
This likely is not a valid entitlement and should be removed from your entitlements file.
(in target 'Sanbox' from project 'Sanbox')
What I verified on the profile Apple just issued
$ security cms -D -i 0596f302-….mobileprovision | plutil -extract Entitlements xml1 -o - -
shows only the baseline four entitlements — application-identifier, keychain-access-groups, get-task-allow, com.apple.developer.team-identifier. com.apple.developer.shazamkit is absent, which is exactly what thread 816377 describes.
What I've already tried
- Deleted and recreated the App ID from scratch — same symptom.
- Performed the capability-toggle trick (uncheck ShazamKit → Save → wait 60s → re-check → Save → delete local profiles → rebuild) documented in the "Capability & entitlement updates" help page (https://developer.apple.com/help/account/reference/capability-entitlement-updates/) for the Game Center precedent — same symptom.
- Confirmed I am building for device, not Simulator.
- Confirmed the entitlement key name matches DTS guidance in thread 799000 and the live profile dumps in thread 816377.
Runtime confirmation
When I force a build with only the team wildcard profile, SHManagedSession().result() returns com.apple.ShazamKit Code=202 "Missing entitlements", wrapping an AMS 306 wrapping HTTP 401 from api.shazam.apple.com/v1/catalog/US/match. AMS server correlation key: E5VYL5YSUT4L55KQDDP4MJQAZE. So the server side is consistent: the token the client presents lacks ShazamKit scope because the binary doesn't carry the entitlement, and the binary doesn't carry it because Apple isn't issuing it into the profile.
Question
Is there a configuration step beyond "tick ShazamKit in App Services" that I've missed for Individual-program accounts, or is this the same backend issuance pathology as thread 816377?
Happy to share the security cms output, the decoded plist, the build log, or anything else useful.
Thanks.
Update / resolution: I re-tested with the entitlement removed from my entitlements file entirely. SHManagedSession().result() against the default Shazam catalog matched a real song cleanly on a physical device, with the app signed against the team wildcard profile carrying only the baseline four entitlements (no com.apple.developer.shazamkit). Confirms what Apple's App Services doc hints at: ShazamKit does not actually require the entitlement in the issued profile for default-catalog matching on iOS. The backend issuance gap is real (and FB22582333 is still filed) but it is not blocking ShazamKit runtime use. Leaving this here in case it saves someone else the signing rabbit hole.