{"registry_version":"2026.1025.387","generated_at":"2026-10-25T06:27:00Z","content_sha256":"089d16f627d9365e3d0663cc8069203706d7cb23a76c332226e29686968811a5","signed":true,"signature":{"key_id":"ed25519:74ca19268e364242","algorithm":"ed25519","expires_at":"2026-11-24T06:27:09Z","expired":false,"manifest":"/registry/manifest.json"},"entry_sha256":"4fd11d5e9b8e6c814202bbecf126a4389ec66774b0384d624ee4052c87092810","entry":{"id":"apple/app-store-connect-api","name":"App Store Connect API key","vendor":"Apple","summary":"Get programmatic access to App Store Connect (builds, TestFlight, metadata, users, provisioning, reports). The Account Holder requests API access once; Apple reviews it; then Admins create team keys (or users create individual keys) whose private .p8 half is downloadable only once and signs 20-minute JWTs.","aliases":["ASC API","App Store Connect API","fastlane API key","Apple API key"],"category":"devtools","group":"B","homepage":"https://developer.apple.com/app-store-connect/api/","docs":["https://developer.apple.com/help/app-store-connect/get-started/app-store-connect-api/","https://developer.apple.com/documentation/appstoreconnectapi/creating-api-keys-for-app-store-connect-api","https://developer.apple.com/documentation/appstoreconnectapi/generating-tokens-for-api-requests"],"status":"researched","last_verified":null,"last_researched":"2026-10-25","sources":[{"id":"help-asc-api","url":"https://developer.apple.com/help/app-store-connect/get-started/app-store-connect-api/","title":"App Store Connect API - Get started - App Store Connect Help","accessed":"2026-10-25","supports":"Account Holder must request access (Users and Access > Integrations > Request Access, agree to terms, submit); requests reviewed and approved case by case; team keys need Account Holder or Admin; individual keys need one of several roles, one active key per user; key name and access level cannot be edited; revoked keys cannot be reinstated; revoked keys from the last 30 days listed; Admin can remove the Generate Individual API Keys permission; keys cannot be used for other Apple services.","kind":"official"},{"id":"create-keys","url":"https://developer.apple.com/documentation/appstoreconnectapi/creating-api-keys-for-app-store-connect-api","title":"Creating API Keys for App Store Connect API","accessed":"2026-10-25","supports":"Team vs individual keys (individual keys cannot use Provisioning endpoints); to generate team keys you must have an Admin account; Admin-role keys can create and delete users; team keys access all apps; private key downloadable a single time and Apple keeps no copy; do not store keys in repositories or client code; revoke if compromised.","kind":"official"},{"id":"tokens","url":"https://developer.apple.com/documentation/appstoreconnectapi/generating-tokens-for-api-requests","title":"Generating Tokens for API Requests","accessed":"2026-10-25","supports":"ES256 JWT; kid = key ID; iss = issuer ID (team keys) or sub (individual keys); aud appstoreconnect-v1; tokens expiring more than 20 minutes ahead are invalid except for listed resources; optional scope claim; where to find issuer ID and key IDs.","kind":"official"},{"id":"forum-access","url":"https://developer.apple.com/forums/thread/110531","title":"AppStore Connect API access request (Apple Developer Forums)","accessed":"2026-10-25","supports":"Apple engineer reply (Nov 2018) that only the team agent / Account Holder can sign the agreement to request API access; May 2021 user reports of a greyed-out Request Access button with no Apple response.","kind":"community"},{"id":"adpla","url":"https://developer.apple.com/support/terms/apple-developer-program-license-agreement/","title":"Apple Developer Program License Agreement","accessed":"2026-10-25","supports":"Must not share, sell or provide access to your developer account or its services to anyone outside your team; you are responsible for safeguarding keys and tokens.","kind":"official"}],"allowed_domains":["appstoreconnect.apple.com","developer.apple.com"],"account_model":{"summary":"API access is switched on per App Store Connect team (one per developer membership) by the Account Holder. Team keys belong to the team, carry a role (e.g. Admin, App Manager, Developer) and see all apps; individual keys inherit one user's apps and permissions.","accounts":[{"name":"Apple Developer Program membership / App Store Connect team","kind":"developer","owned_by":"the company (or individual developer)","required":true},{"name":"Account Holder","kind":"personal","parent":"Apple Developer Program membership / App Store Connect team","required":true,"note":"Only role that can request API access."},{"name":"Admin user","kind":"personal","parent":"Apple Developer Program membership / App Store Connect team","required":false,"note":"Can generate and revoke team keys after access is approved."}],"notes":["Team keys cannot be limited to particular apps; pick the narrowest role that works.","Individual keys cannot use Provisioning endpoints."]},"prerequisites":[{"entry":"apple/developer-program-org","note":"An active membership; individual memberships can also request access."}],"have_ready":[{"kind":"other","description":"The Account Holder available to sign in and accept the API terms.","why":"Only the Account Holder can request access.","needed_for":["request-access"],"auto_check":"none","source":"help-asc-api"},{"kind":"other","description":"A secret store ready for the .p8 file and the decision on which role the key needs.","why":"The key downloads once; its role cannot be changed later.","needed_for":["generate-team-key","download-key"],"auto_check":"none","source":"help-asc-api"}],"steps":[{"id":"sign-in","title":"Sign in to App Store Connect","summary":"Sign in as the Account Holder (first time) or an Admin.","route":"guided","depends_on":[],"gate":"2fa","url":"https://appstoreconnect.apple.com/"},{"id":"request-access","title":"Request API access (Account Holder, once per team)","summary":"In Users and Access > Integrations, click Request Access, tick the box to agree to the terms and submit.","route":"guided","depends_on":["sign-in"],"gate":"human_terms","url":"https://appstoreconnect.apple.com/","sources":["help-asc-api"]},{"id":"access-review","title":"Wait for Apple to approve access","summary":"Apple reviews and approves requests case by case. Team Keys appear once approved.","route":"guided","depends_on":["request-access"],"gate":"third_party_review","lead_time":{"official":{"text":"Reviewed and approved on a case-by-case basis; no timeline published.","source":"help-asc-api"}},"recovery":[{"hiccup":"No Team Keys tab or Generate API Key button.","fix":"Access is not yet approved, or you are not an Admin or Account Holder. Ask the Account Holder to check the request.","source":"help-asc-api"},{"hiccup":"The Request Access button is greyed out.","fix":"Only the Account Holder can request access; sign in as the Account Holder. Users reported the button greyed out even for Account Holders in 2021 with no Apple fix posted - contact Apple Developer Support rather than editing the page.","source":"forum-access"}]},{"id":"generate-team-key","title":"Generate a team API key","summary":"Users and Access > Integrations > App Store Connect API > Team Keys > Generate API Key (+). Name it and choose the role. Name and role cannot be edited later; revoke and recreate to change them.","route":"guided","depends_on":["access-review"],"gate":"human_submit","url":"https://appstoreconnect.apple.com/","sources":["help-asc-api","create-keys"]},{"id":"download-key","title":"Download the private key once","summary":"Click Download API Key next to the new key and store the AuthKey_<KEY_ID>.p8 file in your secret store. The link disappears after one download.","route":"guided","depends_on":["generate-team-key"],"gate":"none","recovery":[{"hiccup":"The download link is gone and the file is lost.","fix":"Apple keeps no copy. Revoke the key and generate a new one (revocation cannot be undone, so update CI first).","source":"create-keys"}],"capture":{"env":"APP_STORE_CONNECT_API_PRIVATE_KEY","kind":"secret"},"sources":["create-keys"]},{"id":"record-ids","title":"Copy the Issuer ID and Key ID","summary":"The Issuer ID is shown near the top of the Integrations page; the Key ID is listed under Active keys.","route":"guided","depends_on":["generate-team-key"],"gate":"none","url":"https://appstoreconnect.apple.com/","sources":["tokens"]},{"id":"individual-key","title":"Or generate an individual key","summary":"From your user profile in App Store Connect, generate an Individual API Key (one active key per user); it carries your own permissions.","route":"guided","depends_on":["access-review"],"gate":"human_submit","recovery":[{"hiccup":"No Generate API Key button on your profile.","fix":"An Admin must grant you the Generate Individual API Keys permission.","source":"create-keys"}],"optional":true,"sources":["help-asc-api","create-keys"]},{"id":"sign-tokens","title":"Sign request tokens","summary":"Sign an ES256 JWT with kid = Key ID and payload iss = Issuer ID, iat, exp (no more than 20 minutes ahead), aud = appstoreconnect-v1, optionally scope to limit requests. Send as a Bearer token.","route":"guided","depends_on":["download-key","record-ids"],"gate":"none","recovery":[{"hiccup":"Requests are rejected as unauthorised.","fix":"Check exp is within 20 minutes, kid matches the key that signed the token, iss is the Issuer ID (team keys), aud is appstoreconnect-v1 and your clock is correct. [to verify] exact error codes.","source":"tokens"},{"hiccup":"Provisioning endpoints refuse an individual key.","fix":"Individual keys cannot use Provisioning endpoints; use a team key.","source":"create-keys"}],"sources":["tokens"]}],"outputs":[{"name":"APP_STORE_CONNECT_ISSUER_ID","description":"Issuer ID for team keys (UUID).","secret":false,"example_format":"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx","from_step":"record-ids"},{"name":"APP_STORE_CONNECT_KEY_ID","description":"Key ID of the API key (JWT kid).","secret":false,"example_format":"ABC123DEFG","from_step":"record-ids"},{"name":"APP_STORE_CONNECT_API_PRIVATE_KEY","description":"The .p8 private key that signs API tokens. Secret; Apple keeps no copy.","secret":true,"example_format":"contents of AuthKey_<KEY_ID>.p8","from_step":"download-key"}],"terms_notes":[{"kind":"rules_say","severity":"red","title":"Admin keys are powerful","text":"Keys with the Admin role can do things like create and delete users, and team keys reach every app. Use the narrowest role and never put keys in repositories or client-side code.","source":"create-keys"},{"kind":"rules_say","severity":"red","title":"Do not share access outside your team","text":"The licence agreement forbids sharing, selling or otherwise providing access to your developer account or its services to anyone who is not an Authorized Developer on your team. The Account Holder also accepts separate API terms when requesting access; read them for limits on third-party use. [to verify] wording of those terms.","source":"adpla"},{"kind":"rules_say","severity":"amber","title":"Revocation is permanent","text":"A revoked API key cannot be reinstated; revoked keys from the last 30 days are listed for reference only.","source":"help-asc-api"}],"renewals":[{"what":"API request token (JWT) - regenerate before it expires (max 20 minutes ahead for most resources)","every":"20 minutes","source":"tokens"}],"pricing_notes":{"notes":"No separate charge stated; requires an Apple Developer Program membership.","source":"help-asc-api"},"api_provisioning":{"available":"partial","notes":"Once you have a team key, the API offers user management and Provisioning endpoints. [to verify] creating API keys appears to be web-only in App Store Connect.","docs":["https://developer.apple.com/documentation/appstoreconnectapi"],"source":"create-keys"}}}