Associated Domains webcredentials works with ?mode=developer but fails without it - AASA correctly configured

Hi everyone,

We're migrating our iOS app from Auth0 custom scheme callbacks to HTTPS Universal URLs using ASWebAuthenticationSession. We've configured everything correctly, but webcredentials only works when using ?mode=developer suffix in our entitlements, which is not allowed for App Store submissions.

The Issue

Without ?mode=developer:

Error Domain=com.apple.AuthenticationServices.WebAuthenticationSession Code=1 "Application with identifier com.example.myapp is not associated with domain auth.example.com. Using HTTPS callbacks requires Associated Domains using the webcredentials service type for auth.example.com."

With ?mode=developer:

<string>webcredentials:auth.example.com?mode=developer</string>

Works perfectly!

Questions

1. Why does it work with ?mode=developer but not without it, even though Apple's CDN has the correct AASA?

2. Is there a way to force iOS to re-verify associated domains without requiring users to delete and reinstall?

3. How will this affect existing users who update the app? Will they need to reinstall?

4. Is there a known propagation delay beyond the CDN showing correct data?

Any guidance would be greatly appreciated. We cannot ship to the App Store with ?mode=developer, but without it, the authentication fails.

Thank you!