MusicTokenRequestError.unknown for some authorized, subscribed users

A small number of our users can’t connect Apple Music because DefaultMusicTokenProvider.userToken(for:options:) always throws MusicTokenRequestError.unknown. Most users connect without problems and we can’t reproduce the failure on any of our own accounts.

Flow:

let status = await MusicAuthorization.request()            // .authorized
let subscription = try await MusicSubscription.current    // canPlayCatalogContent == true

let provider = DefaultMusicTokenProvider()
let developerToken = try await provider.developerToken(options: [])   // succeeds
let userToken = try await provider.userToken(for: developerToken, options: [])  // throws .unknown

On failure we retry once with options: .ignoreCache for both the developer token and the user token. The retry fails in the same way.

What we see on affected devices:

MusicAuthorization.currentStatus == .authorized
MusicSubscription.current.canPlayCatalogContent == true

The developer token is returned successfully. userToken(for:) throws MusicTokenRequestError.unknown. The NSError has code 0 and the localized description “Unknown error”, and there is no NSUnderlyingError.

The ignoreCache retry fails after anywhere from about 10 ms to 2.5 s, so it sometimes appears to go out to the network. For a given account it fails every time: across days, app versions, and after reinstalling both our app and the Music app.

Apple Music plays normally in the Music app for these users.

Ruled out so far:

• iOS version: seen on iOS 26.6.1 and 27.2.
• Device model: seen on iPhone 13 and iPhone 14 Plus.
• Region: seen in Hungary, Italy, Romania and Japan.
• Subscription type: one affected user has an individual trial. A family member with her own individual trial on a separate account connects without problems.
• Family Sharing in general: family plan members connect fine for us.

Questions:

What conditions cause userToken(for:) to return .unknown instead of a specific case such as .userNotSignedIn, .permissionDenied or .privacyAcknowledgementRequired?

Is there a way to get more detail about the cause?

Is there a step affected users can take to fix it?