# Troubleshooting catalog import

> Solve common issues with importing an existing catalog from the App Store or Google Play, such as invalid credentials and missing store permissions.

When you import a catalog from the App Store or Google Play, Unity uses the store credential you provide to read your product listings. If Unity can't read the credential, or the credential can't read your listings, the import fails and Unity adds no listings to your catalog.

Most import failures come from the credential rather than from your catalog data. The most common cause of all is a credential stored in the wrong shape. The issues on this page cover the credential, the permissions on your store API key, and the way Unity matches your application in the store. For the requirements that these issues refer to, refer to [Set up store credentials for catalog import](./store-credentials.md).

Each issue on this page lists the message that the **Import catalog** dialog shows, and the underlying error that identifies the cause.

> **Tip:**
>
> The **Add credential** option in the **Import catalog** dialog assembles the credential from the key that the store issued to you, which avoids the credential shape issues on this page. If you stored a credential in Secret Manager yourself, you can replace it with one that the dialog builds.

## Find the underlying error

The **Import catalog** dialog summarizes why an import failed and, where it can, tells you what to do about it. To identify which of the issues on this page applies, you often need the error underneath that summary.

To read the underlying error, follow these steps:

1. In the failure message, select **Show technical details**.
2. Read the error text, and match it against the issues on this page.
3. Note the request ID, if the dialog shows one.

Include the request ID whenever you contact Unity Support about a failed import. It's the value that identifies your specific request in Unity's logs, and without it a failure is difficult to trace.

On some failures, the dialog shows a reason reported by the store instead of Unity's own guidance, followed by a line that credits it, such as **Reported by App Store Connect** or **Reported by Google Play**. That credit line tells you the wording came from the store rather than from Unity.

## You don't have permission to import

Importing a catalog changes your catalog, so it requires a role with write access.

### Symptoms

You experience one of the following:

* The **Import catalog** button is unavailable, with the tooltip `You don't have permission to change the catalog. Ask an organization owner or manager for access.`
* The import fails with the title `You do not have permission to import` and the message `Ask an organization owner or manager for access to import catalogs.`

### Cause

Your role doesn't allow you to change the catalog. Organization owners and managers have this access, and a plain user has read-only access to the catalog.

### Resolution

Ask an owner or a manager in your organization to either grant you a role with catalog write access, or run the import for you.

## The credential doesn't appear in the dropdown

Unity lists only the secrets that grant access to In-App Purchase. This issue occurs when you store a credential in Secret Manager yourself and don't grant that access.

### Symptoms

You created a secret for your store credential, but it's not available to select in the credential dropdown in the **Import catalog** dialog. The secret appears in Secret Manager as usual, and Secret Manager reports no error.

### Cause

The secret doesn't grant access to In-App Purchase, so Unity doesn't list it as a credential. Service access is separate from the value of the secret, so a correctly formed credential is still invisible without it.

### Resolution

To grant the access, follow these steps:

1. In the [Unity Cloud Dashboard](https://cloud.unity.com/), open the level where you stored the secret and select the edit icon for it.
2. In the service access dropdown, select **In-App Purchase**. For more information, refer to [Service access](/services/secret-manager/concepts/service-access.md).
3. Select **Edit** to save the secret, then open the credential dropdown again.

The dropdown lists the secrets stored at your project, the secrets your project inherits from your organization, and the secrets stored at the environment you're importing into.

## Unity can't find your application in the store

Unity matches your application in the store by the app identifier you enter. This issue occurs when the store account that your credential belongs to has no application with that identifier.

### Symptoms

The import fails with the title `We could not find this app` and a message naming the store, such as `No app with this identifier exists in App Store Connect, or this credential cannot access it.`

The underlying error contains one of the following:

* `platform app identifier not found for credentials: apple: resolve appID: apple: app not found for bundleId`
* `platform app identifier not found for credentials: google: not found`, with `"message": "Package not found"`

### Cause

The identifier doesn't match an application in the store account that your credential belongs to. Common causes include a typo in the identifier and a credential that belongs to a different store account or Google Cloud project. Another cause is an application that you haven't published in the store yet.

Unity accepts identifiers permissively rather than rejecting them by pattern, because the store is the authority on which identifiers exist. A valid identifier reaches this point and fails at the store rather than in the dialog.

### Resolution

To correct the application identifier, follow these steps:

1. In the store, confirm the exact bundle ID or package name of the application whose catalog you want to import.
2. Confirm that the application appears in the same store account that you created the API key or service account in.
3. Import the catalog again, and enter the identifier exactly as the store lists it.

## The secret value isn't valid JSON

Unity expects the secret value to be a single JSON object. This issue occurs when a secret that you stored yourself holds something else, most often the raw contents of a key file.

### Symptoms

The import fails with the title `The store rejected the import`. The underlying error contains one of the following:

* `apple credentials decode: invalid character 'P' looking for beginning of value`
* `apple credentials decode: invalid character '\n' in string literal`
* `google credentials decode: json: cannot unmarshal number into Go value of type platform_catalog.GoogleCredentials`
* `construct google client: google: parse service account JSON: invalid character 'c' after top-level value`

### Cause

The secret value isn't a JSON object that Unity can parse. This happens when you paste a `.p8` private key or a service account key file directly into the secret. It also happens when you escape the contents of the key incompletely.

For a Google Play credential, the most common mistake is escaping the quotes and line breaks of the key file but not its backslashes. The `private_key` member already holds `\n` escape sequences, so each one has to become `\\n` inside the `serviceAccountJSON` string.

### Resolution

Replace the credential with one that the **Add credential** dialog builds, which assembles and escapes the value for you. Alternatively, to correct the secret value yourself, follow these steps:

1. In the [Unity Cloud Dashboard](https://cloud.unity.com/), open the level where you stored the secret and select the edit icon for it.
2. Replace the value with a JSON object that matches the shape for your store, as described in [Set up store credentials for catalog import](./store-credentials.md).
3. Escape the contents of the key for your store. For the App Store, escape each line break in the `.p8` file as `\n`. For Google Play, JSON-escape the whole key file, including every backslash as `\\`.
4. Select **Edit** to save the secret, then import the catalog again.

## The secret is missing a required field

Unity reads specific field names from the secret. This issue occurs when a secret that you stored yourself is valid JSON but doesn't contain the field that Unity expects.

### Symptoms

The import fails with the title `The store rejected the import`. The underlying error contains one of the following:

* `platform credentials invalid or lack required scopes: apple credentials missing "p8"`
* `platform credentials invalid or lack required scopes: google credentials missing "serviceAccountJSON"`

### Cause

The secret value doesn't include the required field, or the field name doesn't match exactly. Field names are case-sensitive. This is common when you store the key file contents as the whole secret value instead of wrapping them in an object.

### Resolution

To add the missing field, follow these steps:

1. In the [Unity Cloud Dashboard](https://cloud.unity.com/), open the level where you stored the secret and select the edit icon for it.
2. Enter a value that wraps your key in the field that Unity expects: `p8`, `keyId`, and `issuerId` for the App Store, or `serviceAccountJSON` for Google Play.
3. Select **Edit** to save the secret, then import the catalog again.

## Unity can't read the private key

Unity parses the private key inside your credential before it calls the store. This issue occurs when the key is present but Unity can't read it as a private key.

### Symptoms

The import fails with the title `The store rejected the import`. The underlying error contains one of the following:

* `construct apple client: apple: failed to decode PEM block from p8 key`
* `google: fetch token: google: unauthorized: failed to retrieve token: private key should be a PEM or plain PKCS1 or PKCS8`

### Cause

The private key is incomplete or malformed. Common causes include a missing `BEGIN PRIVATE KEY` or `END PRIVATE KEY` line, line breaks that you removed or replaced instead of escaping as `\n`, or a truncated copy of the key file.

### Resolution

To replace the private key, follow these steps:

1. Open the key file you downloaded from the store. For the App Store, this is the `.p8` file. For Google Play, this is the service account key file.
2. Copy the whole contents of the file, including the `BEGIN PRIVATE KEY` and `END PRIVATE KEY` lines.
3. In the **Import catalog** dialog, select **Add credential** and paste the file contents, or edit the secret yourself and enter the key with each line break escaped as `\n`.
4. Import the catalog again.

If you no longer have the `.p8` file, create a new App Store Connect API key. App Store Connect lets you download the `.p8` file only once.

## Unity can't find the secret

Unity looks up the secret by its name and scope. This issue occurs when the lookup doesn't find a secret.

### Symptoms

The import fails and the underlying error contains the following:

`platform credentials missing: platform credentials missing in Secret Manager`

### Cause

The secret name or the scope you entered doesn't match a secret that exists. Secret names are case-sensitive, and a secret is visible only at the level where you created it and at any lower level. A secret you created at the environment level isn't available to another environment.

This issue applies mainly to the **Import Catalog** window in the Unity Editor, where you type the name and scope yourself. In the Unity Cloud Dashboard, you select an existing secret instead.

### Resolution

To confirm the secret name and scope, follow these steps:

1. In the [Unity Cloud Dashboard](https://cloud.unity.com/), open the organization, project, or environment you're importing into and select **Secrets**.
2. Confirm that a secret with the name you entered appears in the list, and note the level it's stored at. For more information, refer to [Secret hierarchy](/services/secret-manager/concepts/hierarchy.md).
3. Import the catalog again, and enter the same name and scope as the secret.

## The store API key doesn't have the required permissions

Unity uses your API key to read product listings and pricing. This issue occurs when the credential is valid but the store rejects the request.

### Symptoms

The import fails with the title `The store rejected the import`. The underlying error contains one of the following:

* `platform credentials invalid or lack required scopes`, for an App Store import with a key that Unity can otherwise read
* `google: forbidden`, with `"message": "The caller does not have permission"`, for a Google Play import

### Cause

For the App Store, the API key doesn't have the **App Manager** role or higher, so it can't read pricing information. For Google Play, the service account doesn't have access to your application in the Google Play Console.

### Resolution

To grant the required permissions, do one of the following:

* For the App Store, create a new API key with the **App Manager** role or higher, such as **Admin** or **Account Holder**, then add it as a new credential.
* For Google Play, grant the service account the **Manage store presence** permission for your application, under **Users and permissions** in the Google Play Console. For more information, refer to [Getting started with the Google Play Developer API](https://developers.google.com/android-publisher/getting_started#service-account) (Google).

Permission changes can take a few minutes to apply in the store. If the import still fails immediately after you make a change, wait a few minutes and try again.

## The Google Play Android Developer API isn't enabled

Unity reads Google Play listings through the Google Play Android Developer API. This issue occurs when that API isn't enabled in the Google Cloud project that owns your service account.

### Symptoms

The import fails and the underlying error contains the following:

`Google Play Android Developer API has not been used in project <project number> before or it is disabled`

The error also contains `"reason": "SERVICE_DISABLED"` and a link to enable the API.

### Cause

A Google Cloud service account can only call an API that's enabled in its Google Cloud project. Enabling the API is a separate step from creating the service account and granting it access in the Google Play Console.

### Resolution

To enable the API, follow these steps:

1. Open the link in the error, which points to the Google Play Android Developer API page for the Google Cloud project named in the message. Alternatively, refer to [Getting started with the Google Play Developer API](https://developers.google.com/android-publisher/getting_started#service-account) (Google).
2. Enable the API for that project.
3. Wait a few minutes for the change to apply, then import the catalog again.

## Unity can't reach the store

Unity calls the store while you're in the dialog. This issue occurs when that call doesn't complete.

### Symptoms

The import fails with one of the following:

* The title `Unity could not reach the store` and the message `This is a temporary problem on our side. Try again in a few minutes.`
* The title `Unable to connect to store` and the message `Please verify your credential and app identifier, then try again.`

### Cause

The first message means the request reached Unity but Unity couldn't complete it. The second means the request produced no response at all, which can also follow from a credential or app identifier that the store can't act upon.

### Resolution

Wait a few minutes and import again. If the failure repeats, confirm your credential and app identifier against the other issues on this page, then contact Unity Support with the request ID from **Show technical details**.

## Additional resources

* [Set up store credentials for catalog import](./store-credentials.md)
* [Import a catalog](./dashboard-catalog/import-catalog.md)
* [Create your Remote Catalog](./payment-providers/configure-remote-catalog.md)
* [Store secrets using the Unity Dashboard](/services/secret-manager/tutorials/store-secrets.md)