App Store Connect API Keys: Roles and .p8 Security

Updated October 15, 2026 · by Sardorbek Rakhimov

An App Store Connect API key is the credential that lets tools talk to Apple's official App Store Connect API on your behalf: CI pipelines uploading builds, fastlane pushing metadata, and native desktop clients editing your listings. Every key has a Key ID and a private key file ending in .p8. Team keys also use an Issuer ID in the JWT's iss claim. Individual keys do not use an Issuer ID; Apple's current token format uses sub: user instead. Tools sign short-lived JWTs with the key before making API requests.

Watch: find Team Keys and choose a role

This narrated 1-minute video shows the path from Apps to the key dialog, naming a dedicated key, and selecting Admin for ShipZen's Analytics setup. Continue with the written steps below to generate the key and download its .p8 file.

1:07 · English narration and captions · Recorded October 15, 2026. Open video

Read the video transcript

Go to appstoreconnect.apple.com and sign in.

For a team key, sign in as the Account Holder or an Admin. If API access isn't enabled, the Account Holder must request it and wait for Apple's approval.

From Apps, open the three-dot menu in the top navigation and choose Users and Access. In Users and Access, select the Integrations tab.

Under Integrations, make sure App Store Connect API is selected, then open Team Keys.

Click the blue plus beside Active. On a first-key account, choose Generate API Key. In the dialog, name the key ShipZen tutorial.

For this ShipZen setup, choose Admin. Apple requires it to create Analytics Report requests, and it also covers metadata and releases. Admin grants broad account access, so use a dedicated key for ShipZen.

If you only need metadata and release work, App Manager is a narrower alternative. Team keys apply across all apps, and their role cannot be changed later.

Team keys vs individual keys

Apple issues two kinds of keys, and they are not interchangeable:

Attribute	Team key	Individual key
Scope	All apps in the account, access set by the role you assign	Tied to one user's own apps and permissions
JWT identity claim	`iss` with the account's Issuer ID	`sub: user`; no Issuer ID
Who can create it	Admin (or Account Holder)	Eligible App Store Connect users with permission from an Admin or Account Holder
Provisioning, Sales and Finance, notarytool	Supported	Not available
How many	Multiple keys allowed	One active key per user

Practical rule: shared infrastructure (CI, release tooling, a team's metadata workflow) gets a team key with a deliberately chosen role. An individual key is fine for personal scripts, because it can never exceed what you personally can do — but it also cannot touch provisioning, notarization, or sales reports at all.

A safe connection example

Suppose a two-person team wants a local metadata client. After the Account Holder's API access request is approved, an Admin creates a team key named local-metadata-client with the App Manager role, then gives the client the actual Issuer ID, Key ID, and the saved .p8 file through the client's credential setup. A local client can then sign a short-lived token before asking Apple for the app list. Keep private-key text out of support forms, screenshots, chat, and source code.

If the client supports individual-key authentication, that connection needs the Key ID and .p8 file, but no Issuer ID. A successful app-list request only shows that the current identity can use that endpoint; it does not add app access or turn unsupported account tasks into API operations.

Creating a team key, step by step

Before a team can generate its first key, the Account Holder must request access to the App Store Connect API in Users and Access → Integrations. Apple reviews that request case by case.

In App Store Connect, open Users and Access, then the Integrations tab.
Select App Store Connect API in the left column, then the Team Keys tab.
Click Generate API Key, or the add button (+) if you already have an active key. Name the key after the tool that will use it (one key per tool), and pick a role.
For ShipZen with Analytics, select Admin, then click Generate. For metadata and release work only, App Manager is a narrower alternative.
Copy the Issuer ID and the new key's Key ID from the same page.
Download the .p8 private key and store it somewhere safe immediately.

Admin grants broad account access. ShipZen uses it to create Analytics Report requests; Apple requires Admin when requesting a new report type for the first time. Use a dedicated key for ShipZen, and choose a narrower role when you do not need those operations.

You need an Admin or Account Holder account to generate team keys. Individual keys work differently: eligible users create their own from their profile. If the Generate API Key button is missing, an Admin or Account Holder may need to grant the Generate Individual API Keys permission.

Connection troubleshooting

What you see	Check first	What to do
There is no Issuer ID, or authentication rejects an `iss` claim	Whether you created an individual or team key	Individual-key tokens use `sub: user`, not an Issuer ID. Switch the client to individual-key authentication; for a team key, copy the Issuer ID from App Store Connect instead of inventing one.
The connection works, but an expected app is missing	The key type and the user's app access in Users and Access	A team key applies across the account and cannot be limited per app. An individual key follows that user's access and permissions, so have an Admin review the user's app access. Reconnect after the access change.
An endpoint returns an insufficient-role or forbidden error	The team-key role or individual user's role, and that endpoint's requirements	Grant the smallest role that Apple documents for the needed operation, then create a new team key if its access level must change. Some endpoints have role-specific limits; finance reporting and provisioning are team-key-only, and legal account work remains on the web.

Treat an error as endpoint-specific. A key can authenticate successfully yet still lack permission for a particular operation, and Apple does not expose every App Store Connect web workflow through the API.

Which role should the key get?

Key roles are the same roles Apple defines for users, and the least-privilege logic is the same too:

Developer — uploads builds and manages TestFlight builds. Enough for most CI pipelines that only ship binaries.
App Manager — everything release-shaped: builds, versions, App Store metadata, pricing, submissions. A narrower choice for release tooling and metadata editors that do not create Analytics Report requests.
Finance — payments and financial reports. Use it when a tool needs finance reports or payment data. For Sales and Trends reports or Analytics Reports, the narrower Sales and Reports role may be enough; it cannot download finance reports. Sales and finance endpoints require a team key.
Admin — broad account access, including user management and account-wide settings. Apple also requires it to request a new Analytics Report type for the first time. This is the role used in the ShipZen video above.

One thing a role cannot fix: team keys apply across every app in the account. If a contractor should only touch one app, an individual key tied to their scoped user account models that better than any team key role.

.p8 security rules

Apple allows the private key to be downloaded exactly once. That rule drives all the handling guidance:

Store it in a real secret store: the macOS Keychain on a workstation, your CI provider's encrypted secrets otherwise.
Never commit it, paste it into chat tools, or bake it into build artifacts.
Lost the file? There is no re-download — revoke the key and create a new one.
Most App Store Connect JWTs can be valid for at most 20 minutes. Apple's token format also supports optional scopes that restrict the operations a token can authorize.
Suspect a leak? Revoke immediately in Users and Access. Revocation is permanent (revoked keys cannot be reinstated), and the key stops working for every tool that held it.
Name keys per tool so revoking one integration never breaks the others.

The same standard applies to vendors: any app or service that asks you to upload your .p8 to their servers is asking you to trust their security team with whatever access the key's role or user permissions allow. A local-first tool avoids sharing the credential with the vendor; a hosted tool requires you to assess the vendor's storage, access controls, and revocation process.

What the API can and can't do

A key with the right role covers the daily publishing surface: app metadata and screenshots, TestFlight, customer reviews, analytics and sales reports, and pricing. It does not cover everything Apple's website can do:

Privacy nutrition labels have no official public write API — privacy declarations still happen in the App Store Connect web UI.
Agreements, banking, and tax are account-legal surfaces handled on the web, mostly by the Account Holder role — see our Apple Developer account setup guide.

A trustworthy tool is explicit about that boundary instead of promising to automate all of it — more on that in what a desktop client can and can't do.

Where ShipZen fits

ShipZen is a native macOS App Store Connect client that authenticates with your own API key and stores it in the macOS Keychain. Requests go directly from your Mac to Apple — there is no ShipZen server in the middle, so your .p8 never leaves your machine. An App Manager team key, or an individual key whose user has access to the relevant apps and operations, can cover supported metadata and validator workflows. Reporting features depend on Apple's endpoint-specific roles. See the security and capability matrix for the product boundary.

Team-key navigation and Analytics role guidance rechecked October 15, 2026. See the editorial policy for sourcing and corrections.

Make the next listing update less work. Edit across locales and review changes before saving.

Download on the Mac App Store

Available on the Mac App Store.