device:create / build fails with "Authentication with Apple Developer Portal failed! iTunes service key is empty"

### Build/Submit details page URL

_No response_

### Summary

**Summary**
`eas device:create` (and later `eas build --platform ios --profile development`) fails
with:

Authentication with Apple Developer Portal failed!
iTunes service key is empty

**What I already tried (none fixed it):**
- EXPO_NO_KEYCHAIN=1
- rm -f /tmp/spaceship_itc_service_key.txt
- rm -rf ~/.app-store
- Accepted a pending Apple Developer Program License Agreement in App Store Connect
(was genuinely pending, now accepted — error persists)
- Confirmed my Apple Developer account role is "Account Holder" (individual account)
- Manually registered the App ID and the device in
developer.apple.com/account/resources (bypassing eas device:create) — build still
fails at the same authentication step

### Managed or bare?

bare

### Environment

**Environment**
- eas-cli: 24.3.0
- expo SDK: 57.0.22
- OS: macOS 26.5.2 (darwin-arm64), node v24.19.0
- Individual Apple Developer account, freshly approved a few weeks ago

### Error output

EXPO_DEBUG=true EXPO_NO_KEYCHAIN=1 npx eas-cli@latest device:create
› Skip storing Apple ID password in the local Keychain.
Authentication with Apple Developer Portal failed!
iTunes service key is empty
AssertionError [ERR_ASSERTION]: iTunes service key is empty
at t.getItunesConnectServiceKeyAsync (/Users/hugofarias/.npm/_npx/6bc7bae5c2059953/node_modules/@expo/apple-utils/build/index.js:1:828767)
at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
at async Object.S [as loginWithUserCredentialsAsync] (/Users/hugofarias/.npm/_npx/6bc7bae5c2059953/node_modules/@expo/apple-utils/build/index.js:1:816037)
at async loginWithUserCredentialsAsync (/Users/hugofarias/.npm/_npx/6bc7bae5c2059953/node_modules/eas-cli/build/credentials/ios/appstore/authenticate.js:84:24)
at async loginAsync (/Users/hugofarias/.npm/_npx/6bc7bae5c2059953/node_modules/eas-cli/build/credentials/ios/appstore/authenticate.js:56:16)
at async authenticateAsUserAsync (/Users/hugofarias/.npm/_npx/6bc7bae5c2059953/node_modules/eas-cli/build/credentials/ios/appstore/authenticate.js:128:27)
at async authenticateAsync (/Users/hugofarias/.npm/_npx/6bc7bae5c2059953/node_modules/eas-cli/build/credentials/ios/appstore/authenticate.js:101:16)
at async AppStoreApi.ensureAuthenticatedAsync (/Users/hugofarias/.npm/_npx/6bc7bae5c2059953/node_modules/eas-cli/build/credentials/ios/appstore/AppStoreApi.js:37:28)
at async DeviceManager.createAsync (/Users/hugofarias/.npm/_npx/6bc7bae5c2059953/node_modules/eas-cli/build/devices/manager.js:28:30)
at async DeviceCreate.runAsync (/Users/hugofarias/.npm/_npx/6bc7bae5c2059953/node_modules/eas-cli/build/commands/device/create.js:27:9) {
generatedMessage: false,
code: 'ERR_ASSERTION',
actual: undefined,
expected: true,
operator: '==',
diff: 'simple'
}
Error: device:create command failed.

### Reproducible demo or steps to reproduce from a blank project

Steps to reproduce (from a blank project):

npx create-expo-app@latest repro-eas-bug
cd repro-eas-bug
npx eas-cli@latest login
npx eas-cli@latest build:configure
# select iOS when prompted
EXPO_DEBUG=true npx eas-cli@latest device:create
# enter Apple ID email/password when prompted

Environment:

eas-cli: 24.3.0
expo SDK: 57.0.22
macOS 26.5.2 (darwin-arm64)
node v24.19.0
Apple Developer Program: active individual membership, Account Holder role, agreement already accepted

Expected behavior: Apple ID authentication succeeds and the device gets registered.

Actual behavior: Fails every time, on both a real project and this fresh blank project, with the same error:

Authentication with Apple Developer Portal failed!
iTunes service key is empty
AssertionError [ERR_ASSERTION]: iTunes service key is empty
at t.getItunesConnectServiceKeyAsync (/Users/hugofarias/.npm/_npx/6bc7bae5c2059953/node_modules/@expo/apple-utils/build/index.js:1:828767)
at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
at async Object.S [as loginWithUserCredentialsAsync] (/Users/hugofarias/.npm/_npx/6bc7bae5c2059953/node_modules/@expo/apple-utils/build/index.js:1:816037)
at async loginWithUserCredentialsAsync (/Users/hugofarias/.npm/_npx/6bc7bae5c2059953/node_modules/eas-cli/build/credentials/ios/appstore/authenticate.js:84:24)
at async loginAsync (/Users/hugofarias/.npm/_npx/6bc7bae5c2059953/node_modules/eas-cli/build/credentials/ios/appstore/authenticate.js:56:16)
at async authenticateAsUserAsync (/Users/hugofarias/.npm/_npx/6bc7bae5c2059953/node_modules/eas-cli/build/credentials/ios/appstore/authenticate.js:128:27)
at async authenticateAsync (/Users/hugofarias/.npm/_npx/6bc7bae5c2059953/node_modules/eas-cli/build/credentials/ios/appstore/authenticate.js:101:16)
at async AppStoreApi.ensureAuthenticatedAsync (/Users/hugofarias/.npm/_npx/6bc7bae5c2059953/node_modules/eas-cli/build/credentials/ios/appstore/AppStoreApi.js:37:28)
at async DeviceManager.createAsync (/Users/hugofarias/.npm/_npx/6bc7bae5c2059953/node_modules/eas-cli/build/devices/manager.js:28:30)
at async DeviceCreate.runAsync (/Users/hugofarias/.npm/_npx/6bc7bae5c2059953/node_modules/eas-cli/build/commands/device/create.js:27:9) {
generatedMessage: false,
code: 'ERR_ASSERTION',
actual: undefined,
expected: true,
operator: '==',
diff: 'simple'
}
Error: device:create command failed.

Already ruled out: cleared macOS Keychain entries (EXPO_NO_KEYCHAIN=1), cleared /tmp/spaceship_itc_service_key.txt, cleared ~/.app-store, confirmed the Apple Developer Program License Agreement is accepted, confirmed Account Holder/Admin role on the Apple account, manually registered the Bundle ID and device UDID directly on developer.apple.com as a workaround (build still fails with the identical error). This points to getItunesConnectServiceKeyAsync failing to retrieve a service key from Apple's side (possibly related to appstoreconnect.apple.com/olympus/v1/app/config?hostname=itunesconnect.apple.com returning an unexpected response — see related report on Apple Developer Forums, thread 845368), not to any local misconfiguration.

Reproduce the blank-project flow with EXPO_DEBUG=true, then trace authentication from commands/device/create.js through devices/manager.js, ios/appstore/AppStoreApi.js, and credentials/ios/appstore/authenticate.js. Inspect the reported getItunesConnectServiceKeyAsync failure in @expo/apple-utils and compare Apple's response with the linked forum report. Done means Apple ID authentication succeeds and device:create can register the device without the empty-service-key error.

Written by the indexing model from the issue text.