Websites · Glossary
What is an App Store Connect API key?
An App Store Connect API key is a private key, downloaded as a .p8 file, that lets software act on your Apple developer account through the App Store Connect API. A tool uses it with the key's ID and your team's issuer ID to sign short lived tokens, so it can upload builds, manage certificates or submit apps without your Apple password.
Build services ask for this key so they can sign and upload iPhone apps on your behalf. It is powerful, it downloads only once, and it should be treated like a password.
Nuwan Madhusanka · Co-founder
4 min read · Published
| Part | What it is | Where to find it |
|---|---|---|
| Issuer ID | Identifies your team's App Store Connect account | Users and Access, Integrations, App Store Connect API |
| Key ID | Identifies one key | The keys list next to the key's name |
| Private key (.p8 file) | Signs the tokens a tool sends to Apple | Downloaded once when the key is created |
What it is
Apple's App Store Connect API is a REST API for tasks you would otherwise do in the App Store Connect website: managing builds, TestFlight testers, certificates, devices and app metadata. Programs authenticate with a JSON Web Token signed by a private key you create in App Store Connect. Apple offers team keys, created by the Account Holder or an Admin and given a role, and individual keys tied to one user. Apple's help states that API keys are private and can only be downloaded once, so the .p8 file must be stored safely when it is created.
How tools use it
A build or submission tool asks for the issuer ID, the key ID and the .p8 file. For each request it creates a short lived token signed with the private key, and Apple checks the signature and the key's role. With an Admin or App Manager key, a service such as EAS can create distribution certificates and provisioning profiles, register the app's bundle identifier and upload builds to App Store Connect. Because the key works without two factor prompts, it lets automated builds run without anyone signing in.
When it matters
You meet this key when you want iPhone builds made by a cloud service, or when you automate submissions and TestFlight uploads. It matters for small businesses because the alternative, sharing an Apple ID password with a developer or service, is riskier and breaks with two factor authentication. It also matters at handover: a key created for a contractor should be revoked when the work ends.
Common mistakes
Losing the .p8 file and assuming it can be downloaded again; it cannot, so a new key is needed. Emailing the file or committing it to a code repository. Creating every key with the Admin role when a narrower role would do. Never revoking keys for people or services no longer in use. Confusing it with other Apple keys, such as the key for push notifications or for in app purchase server notifications, which do different jobs. And mixing up the issuer ID and key ID when pasting them into a tool.
Where it shows up in OneCraft
OneCraft runs Expo builds for Android or iPhone on paid plans, as a test build or a store build at 5 credits each, on OneCraft's Expo organisation unless the owner connects their own token. iPhone builds need the owner's Apple key; Android builds do not. The owner submits to the App Store and Google Play from their own accounts with eas submit: Apple charges 99 USD a year for its developer programme and Google Play 25 USD once. OneCraft does not submit apps to the stores.
Questions people ask
Is an App Store Connect API key the same as my Apple ID password?
No. The key is a separate credential made for software. It can be limited by role, revoked at any time without changing your password, and it works without two factor prompts. Your Apple ID password should never be shared with a build service.
Who can create an App Store Connect API key?
Team keys are created by the Account Holder or an Admin in Users and Access, under Integrations. Individual keys belong to one user and follow that user's permissions. Organisations may need to request access to the API first, which Apple reviews.
What happens if my .p8 file leaks?
Revoke the key in App Store Connect straight away, then create a new one and update the tools that used it. Apple's help notes a revoked key cannot be reinstated. Check recent activity, such as new certificates or builds you did not expect.
Do I need an API key for Android builds?
No. Google Play uses different credentials. Android apps are signed with an upload keystore, and automated uploads to Google Play use a Google Cloud service account key with access granted in Play Console. The App Store Connect key only applies to Apple.
Does the key expire?
API keys do not expire on a fixed schedule, but the tokens a tool signs with them last only minutes. A key stays valid until it is revoked. Review active keys from time to time and revoke any that are no longer used.
Make one with websites
The button opens the generator with this use case already described. Change the wording to match your own.
Create a website with OneCraftRelated questions
- What is a provisioning profile on iPhone?What is a provisioning profile? The Apple file that ties an app ID, a signing certificate and allowed devices together so an iPhone will run the app.
- Development build vs production build in ExpoDevelopment build vs production build in Expo: what each EAS build profile is for, who can install it, how it is signed and which one goes to the stores.
- How much does the Apple Developer Program cost?Apple Developer Program cost: 99 USD a year for individuals and organisations, with waivers for some nonprofits. What it includes and what it does not.
- What is a TestFlight build?What is a TestFlight build? Apple's beta channel for iPhone apps: internal and external testers, beta review and the 90 day expiry, explained in plain English.
Written and checked by the OneCraft team. Last checked .