Unable to get certificates via TKTokenWatcher

Hello,

We have an application which gets our HSM certificates via TKTokenWatcher, there is a snippet:

let tokens = TKTokenWatcher()
 for token in tokens.tokenIDs {
 // Use our HSM certs
 if token.contains("SPECIFIC_IDENTIFIER") {
     let tokenQuery = [kSecClass as String: kSecClassIdentity,
     kSecAttrTokenID as String: token,
     kSecAttrKeyType as String: kSecAttrKeyTypeRSA,
     kSecReturnRef as String: true] as CFDictionary
                
    var item: CFTypeRef?
    let result = SecItemCopyMatching(tokenQuery as CFDictionary, &item)
    if result == noErr....

Normally, result is all right, but problem occurred when we added "App Groups" entitlement. This application has to share some Defaults with other app, so they need to be in the same App Group.

So, when we added this App Group entitlement, result from the code snippet is -34018, which according to OSStatus means errSecMissingEntitlement.

Does anybody know, which entitlement has to be added, so app can be in the App Group, and at the same time it is able to get certificates?

Thank you.