Sync failures fall into a small number of buckets. The Sync History tab shows the exact API error from Apple, the duration, and the time it ran. That's usually enough to tell which bucket you're in.
The error buckets
- Invalid credentials (401)
- The Issuer ID, Key ID, or .p8 are wrong, or the key has been revoked in App Store Connect. Generate a new key and update the connection.
- Insufficient role (403)
- The API key works but doesn't have permission for what HexSign tried to do; typically the key was created with the Developer role instead of Admin. Re-issue the key with Admin scope.
- Rate limited
- App Store Connect throttles requests per key. HexSign retries with exponential back-off and the next scheduled sync usually clears it.
- Apple service error (5xx)
- App Store Connect itself is having a bad day. HexSign's next scheduled sync will retry; you can also click Sync now once Apple's status page is green.
Resolve it
- 1
Open Sync History
From the Apple Account's detail page, click Sync History. The most recent failed run is at the top, with the underlying API error message expanded.
- 2
Match the error to a bucket
Use the table above to map the error code to a fix. 401 and 403 errors require updating the key; 5xx and rate-limit errors are transient.
- 3
Update the key or retry
For credential and role errors, click Edit credentials and paste the new Issuer ID, Key ID, and .p8. For transient errors, click Sync now.