@kapa.ai when I am creating the appleads connector, am getting this below error 'Encountered an error while checking availability of stream campaigns. Error: 400 Client Error: Bad Request for url: appleid.apple.com/auth/oauth2/token?grant_type=client_credentials&scope=searchadsorg' ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.11/site-packages/backoff/_sync.py", line 105, in retry ret = target(*args, **kwargs) ^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.11/site-packages/airbyte_cdk/sources/streams/http/requests_native_auth/abstract_oauth.py", line 222, in _make_handled_request response.raise_for_status() File "/usr/local/lib/python3.11/site-packages/requests/models.py", line 1024, in raise_for_status raise HTTPError(http_error_msg, response=self) requests.exceptions.HTTPError: 400 Client Error: Bad Request for url: appleid.apple.com/auth/oauth2/token?grant_type=client_credentials&scope=searchadsorg 2026-09-23 141007 error Check failed 2026-09-23 141007 info Checking for optional control message... 2026-09-23 141007 info Writing output of e59c8416-c2fa-4bd3-9e95-52677ea281c1_984f267d-d3c3-4f30-a28f-a4941e7548a5_0_check to the doc store 2026-09-23 141008 info Marking workload e59c8416-c2fa-4bd3-9e95-52677ea281c1_984f267d-d3c3-4f30-a28f-a4941e7548a5_0_check as successful 2026-09-23 141008 info Deliberately exiting process with code 0. 2026-09-23 141008 info 2026-09-23 141008 info ----- END CHECK ----- 2026-09-23 141008 info

Thinking completed The

400 Client Error: Bad Request

when requesting a token from

https://appleid.apple.com/auth/oauth2/token

indicates an authentication failure with your OAuth credentials rather than an issue with the connector itself [Amazon-Seller-Partner Connection Error]. For Apple Ads (Apple Search Ads), Airbyte uses a two-legged machine-to-machine OAuth flow using a Client ID and a generated Client Secret [Unique Connector Behaviors]. When Apple's token endpoint returns a

400 Bad Request

, it usually means one of the following: 1. The Client Secret is invalid, malformed, or expired • Expired Client Secret: The

client_secret

required by Apple is a self-signed ES256 JWT. Apple restricts the maximum expiration (

exp

) of this JWT to 180 days. If the JWT has expired, requests to the token endpoint will fail [Unique Connector Behaviors]. • Incorrect JWT Format: Ensure that the client secret has been generated properly according to Apple's specifications (signed using your private key and matching the public key registered in Apple Ads) [Setup guide; Unique Connector Behaviors]. 2. Mismatch between Client ID and Client Secret • Ensure the Client ID entered into Airbyte exactly matches the API user/application credentials under which the public key was uploaded and the secret was generated [Setup guide]. How to resolve: 1. Follow Apple's documentation on Implementing OAuth for the Apple Ads API to generate a fresh ES256 client secret JWT [Setup guide; Unique Connector Behaviors]. 2. Re-enter the valid Client ID and newly generated Client Secret in your Airbyte source configuration [Setup guide]. 👍 0 button 👎 0 button ℹ️ Tip: Mention @kapa.ai in the thread for follow-ups or DM the app for 1-to-1 help.

I have followed all the steps as per the documentaion and generated the clinet secret

Thinking completed If you have generated the credentials according to Apple's documentation and are still receiving the

400 Bad Request

from

https://appleid.apple.com/auth/oauth2/token

, double-check the specific technical requirements for the Client Secret and connector setup: 1. Client Secret JWT generation requirements The client secret for Apple Ads is not a simple string or API key; it must be a signed ES256 JSON Web Token (JWT) [Unique Connector Behaviors]. If any parameter in the JWT header or payload is wrong, Apple's OAuth server will reject the token request with a `400 Bad Request`: • Key algorithm: The private/public key pair must be generated using the ECDSA P-256 (

prime256v1

) curve, and the token signed with the

ES256

algorithm [Unique Connector Behaviors]. • Expiration (

exp

): Apple enforces a strict maximum lifetime of 180 days on the JWT [Unique Connector Behaviors]. Ensure the

exp

claim does not exceed 180 days from the issue time (

iat

). • Required Claims: Verify against Apple's Implementing OAuth for the Apple Ads API that all headers (

alg

,

kid

) and payload claims (

sub

,

aud

,

iss

, etc.) strictly match the values associated with your Apple Ads API user and key ID [Setup guide; Unique Connector Behaviors]. 2. Verify Airbyte configuration inputs • No extra whitespace: Check that no accidental leading/trailing spaces or line breaks were introduced when pasting the

client_id

or the long

client_secret

JWT string into Airbyte. • Client ID: Ensure you are passing the exact

client_id

associated with that public key/API user in the Apple Ads account [Setup guide]. • Token Refresh Endpoint: Unless you are proxying requests through a custom gateway, ensure the Token Refresh Endpoint setting is left at its default value:

https://appleid.apple.com/auth/oauth2/token?grant_type=client_credentials&scope=searchadsorg

[Setup guide; manifest.yaml]. 3. Verify the token request manually To isolate whether the issue is with the token generation or Airbyte, test exchanging the client secret directly using a tool like `curl`:

curl -X POST "https://appleid.apple.com/auth/oauth2/token?grant_type=client_credentials&scope=searchadsorg" \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -d "client_id=<YOUR_CLIENT_ID>" \
     -d "client_secret=<YOUR_GENERATED_JWT>"

Apple will return a JSON error response body (such as

{"error":"invalid_client"}

) detailing why the token request was rejected. 👍 0 button 👎 0 button ℹ️ Tip: Mention @kapa.ai in the thread for follow-ups or DM the app for 1-to-1 help.

@kapa.ai given only this { "error": "invalid_client" }

Thinking completed An

{"error": "invalid_client"}

response directly from Apple's OAuth server indicates that Apple failed to authenticate your client credentials [Troubleshooting Common OAuth Issues]. When using the Apple Ads connector, this error typically occurs due to one of the following: 1. Incorrect Client ID or Mismatch: ◦ The

client_id

entered does not exactly match the Client ID assigned to the API user in your Apple Ads account [Troubleshooting Common OAuth Issues; Setup guide]. ◦ Verify that there are no extra spaces, characters, or typos when copying and pasting the Client ID into Airbyte. 1. Issues with the Client Secret JWT: ◦ Key Mismatch / Wrong Key: The JWT was signed with a private key that does not match the public key currently uploaded for that API user in the Apple Ads account [Setup guide; Unique Connector Behaviors]. ◦ Incorrect JWT Claims or Headers: In the self-signed ES256 JWT, claims such as

sub

(subject),

iss

(issuer),

aud

(audience), or the header key ID (

kid

) must strictly match Apple's specifications for that API user [Unique Connector Behaviors]. If any value is incorrect, Apple marks the client as invalid. ◦ Expired Token: Apple restricts the expiration (

exp

) claim on the JWT to a maximum of 180 days [Unique Connector Behaviors]. How to resolve: • Re-check your API user setup in Account Settings → User Management in Apple Ads [Setup guide]. • Re-generate the ES256 JWT using the correct private key, ensuring all claims (

sub

,

iss

,

aud

,

kid

) match Apple's requirements, and update the Client ID and Client Secret fields in Airbyte [Setup guide; Unique Connector Behaviors]. 👍 0 button 👎 0 button ℹ️ Tip: Mention @kapa.ai in the thread for follow-ups or DM the app for 1-to-1 help.

@kapa.ai every time I generate the client secret, the client_id will change ?

Thinking completed The provided knowledge sources do not explicitly mention whether the

client_id

changes each time you generate a new

client_secret

. According to the setup guide, the

client_id

is tied to the API user role created under Account Settings → User Management in Apple Ads [Setup guide]. Because the

client_secret

is a self-signed ES256 JWT generated from your key pair, refreshing or re-signing an expired or updated JWT typically uses the existing API user's credentials rather than creating a new client identity [Unique Connector Behaviors]. However, for the exact behavior regarding key rotation and user management on Apple's platform, please refer to Apple's guide on Implementing OAuth for the Apple Ads API [Setup guide]. 👍 0 button 👎 0 button ℹ️ Tip: Mention @kapa.ai in the thread for follow-ups or DM the app for 1-to-1 help.