403: Unauthorized received on accounts with two-factor enabled.

[evertwoud]

When trying downloading a version using the install command using a device that has two-factor enabled a 403: Unauthorized is shown.
The username & password are correctly entered and when running the command a two-factor code is shown on the device itself.
The terms & conditions are setup correctly and there are no other weird restrictions on the account(s) (I've tested multiple).

evertwoud@evertwoud ~ % xcodes install 26.4.1

(1/6) Found existing archive that will be used for installation at /Users/evertwoud/Library/Application Support/com.robotsandpencils.xcodes/Xcode-26.4.1+17E202.xip.
(2/6) Unarchiving Xcode (This can take a while)
Using regular unxip. Try passing `--experimental-unxip` for a faster unxip process
The archive "Xcode-26.4.1+17E202.xip" is damaged and can't be expanded.
Removing damaged XIP and re-attempting installation.


Downloading with aria2 (/opt/homebrew/bin/aria2c)

 Received 403: Unauthorized. This can happen when either:
 1. Apple Developer Terms and Conditions were not accepted at https://developer.apple.com/
 2. Apple ID authorization was revoked for some other reason

[harrimaatta]

I can confirm this observation. I've encountered the same issue and have tested it with multiple user accounts as well. I also changed the account passwords via https://account.apple.com/account/manage, as suggested in #395 for another sign-in related issue. Unfortunately, this did not have the desired effect.

[pullely-samuel]

I can reproduce this with xcodes 2.0.1 on macOS 26.5.1 using an Apple ID with 2FA enabled. The latest Apple Developer agreements have been accepted.

Authentication triggers the trusted-device verification prompt, but the download produces a very small invalid .xip. After xcodes detects and removes it, retrying fails with 403 Unauthorized.