Sync failures fall into a small number of buckets. The Sync History tab shows the exact API error from Apple, the duration, and the time it ran — usually enough to tell which bucket you're in.
The error buckets
- Invalid credentials (401)
- The Issuer ID, Key ID, or .p8 are wrong, or the key has been revoked in App Store Connect. Generate a new key and update the connection.
- Insufficient role (403)
- The API key works but doesn't have permission for what HexSign tried to do — typically the key was created with the Developer role instead of Admin. Re-issue the key with Admin scope.
- Rate limited
- App Store Connect throttles requests per key. HexSign retries with exponential back-off and the next scheduled sync usually clears it.
- Apple service error (5xx)
- App Store Connect itself is having a bad day. HexSign's next scheduled sync will retry; you can also click Sync now once Apple's status page is green.
Resolve it
- 1
Open Sync History
From the Apple Account's detail page, click Sync History. The most recent failed run is at the top, with the underlying API error message expanded.
- 2
Match the error to a bucket
Use the table above to map the error code to a fix. 401 and 403 errors require updating the key; 5xx and rate-limit errors are transient.
- 3
Update the key or retry
For credential and role errors, click Edit credentials and paste the new Issuer ID, Key ID, and .p8. For transient errors, click Sync now.