Originally published on hexisteme notes.
I shipped seven versions of my apps in thirty days by scripting the App Store Connect API end to end — build metadata, screenshots, submission, the works. Somewhere in that cadence I ran into three completely independent hard limits in the ASC API, each one verified live against my own apps on 2026-06-13. None of the three error messages point at their actual cause. One blames your credentials for what's really a clock problem. One tells you the app is in "the current state" without saying which state, or why that matters. One just says a count is over budget and leaves you to discover, the hard way, that the same API that created the excess item won't let you delete it either. Here's what each wall looks like, and the two-call pre-flight that catches all three before a script finds out about them for you.
The JWT 20-minute cap
Every call to the ASC API runs on a JWT you sign yourself — issuer ID, key ID, ES256 private key. What isn't obvious until you hit it: Apple enforces exp - iat <= 1200 seconds (20 minutes) as a hard cap on that token, no matter how far out you set exp. Set exp to iat + 1200 exactly and the token works. Set it to iat + 1201 — one second past the cap — and every call made with that token fails, even with a perfectly valid ES256 signature:
