Hello Devs,
I'm encountering a persistent INTERNAL_ERROR (HTTP 500) when making Server-to-Server API calls to CloudKit, specifically when trying to hit the /users/current endpoint, even after meticulously verifying all client-side components. I'm hoping someone might have insight into what could cause this.
Context:
Goal: Authenticate to CloudKit from a Vercel Serverless Function (Node.js) to perform operations like record queries.
Problem Endpoint: POST https://api.apple-cloudkit.com/database/1/iCloud.com.dannybaseball.Danny-Baseball/production/public/users/current
Key Generation Method: Using the CloudKit Dashboard's "Tokens & Keys" -> "New Server-to-Server Key" flow, where I generate the private key using openssl ecparam -name prime256v1 -genkey -noout -out mykey.pem, then extract the public key using openssl ec -in mykey.pem -pubout, and paste the public key material (between BEGIN/END markers) into the dashboard. The private key was then converted to PKCS#8 format using openssl pkcs8 -topk8 -nocrypt -in mykey.pem -out mykey_pkcs8.pem.
Current Setup Being Tested (in a Vercel Node.js function):
CLOUDKIT_CONTAINER: iCloud.com.dannybaseball.Danny-Baseball
CLOUDKIT_KEY_ID: 9368dddf141ce9bc0da743b9f69bc3eda132b9bb3e62a4167e428d4f320b656e (This is the Key ID generated from the CloudKit Dashboard for the public key I provided).
CLOUDKIT_P8_KEY (Environment Variable): Contains the base64 encoded string of the entire content of my PKCS#8 formatted private key file.
Key Processing in Code:
const p8Base64 = process.env.CLOUDKIT_P8_KEY;
const privateKeyPEM = Buffer.from(p8Base64, 'base64').toString('utf8');
// This privateKeyPEM string starts with "-----BEGIN PRIVATE KEY-----" and ends with "-----END PRIVATE KEY-----"
const privateKey = crypto.createPrivateKey({ key: privateKeyPEM, format: 'pem' });
// This line SUCCEEDS without DECODER errors in my Vercel function logs.
Use code with caution.
JavaScript
Request Body for /users/current: "{}"
Signing String (message = Date:BodyHash:Path):
Date: Correct ISO8601 format (e.g., "2025-05-21T19:38:11.886Z")
BodyHash: Correct SHA256 hash of "{}", then Base64 encoded (e.g., "RBNvo1WzZ4oRRq0W9+hknpT7T8If536DEMBg9hyq/4o=")
Path: Exactly /database/1/iCloud.com.dannybaseball.Danny-Baseball/production/public/users/current
Headers:
X-Apple-CloudKit-Request-KeyID: Set to the correct Key ID.
X-Apple-CloudKit-Request-ISO8601Date: Set to the date used in the signature.
X-Apple-CloudKit-Request-SignatureV1: Set to the generated signature.
X-Apple-CloudKit-Environment: "production"
Content-Type: "application/json"
Observed Behavior & Logs:
The Node.js crypto.createPrivateKey call successfully parses the decoded PEM key in my Vercel function.
The request is sent to CloudKit.
CloudKit responds with HTTP 500 and the following JSON body (UUID varies per request):
{
"uuid": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"serverErrorCode": "INTERNAL_ERROR"
}
Use code with caution.
Json
This happens consistently. Previously, with other key pairs or different P8 processing attempts, I was getting AUTHENTICATION_FAILED (401) or local DECODER errors. Now that the key parsing is successful on my end with this current key pair and setup, I'm hitting this INTERNAL_ERROR.
Troubleshooting Done:
Verified Key ID (9368dddf...) is correct and corresponds to the key generated via CloudKit Dashboard.
Verified Container ID (iCloud.com.dannybaseball.Danny-Baseball) is correct.
Successfully parsed the private key from the environment variable (after base64 decoding) within the Vercel function.
Meticulously checked the signing string components (Date, BodyHash, Path) against Apple's documentation. Path format is /database/1////.
Ensured all required headers are present with correct values.
Local Node.js tests (bypassing Vercel but using the same key data and signing logic) also result in this INTERNAL_ERROR.
Question:
What could cause CloudKit to return an INTERNAL_ERROR (500) for a /users/current request when the client-side key parsing is successful and all request components (path, body hash for signature, date, headers) appear to conform exactly to the Server-to-Server Web Services Reference?
Are there any known subtle issues with EC keys generated via openssl ecparam (and then converted to PKCS#8) that might lead to this, even if crypto.createPrivateKey parses them in Node.js?
Could there be an issue with my specific Key ID or container that would manifest this way, requiring Apple intervention?
Any insights or suggestions would be greatly appreciated. I can provide more detailed logs of the request components if needed.
Thank you!
