Notably, you need to get this right on the first try (or at minimum the first try), or Apple appears to get suspicious for requests from your IP.