App Store Connect API key

An App Store Connect API key is the credential that lets tooling talk to App Store Connect without an Apple ID password or a two-factor prompt, and it is three separate things: an Issuer ID, a Key ID, and a .p8 private key file.

The parts, and what each one actually is:

• Issuer ID is a UUID identifying your team. It is the same for every key on the account, and it is printed above the key list, not inside the key.
• Key ID is a ten character identifier for this one key. It also appears in the downloaded filename, AuthKey_ABC1234DEF.p8.
• .p8 file is the private key itself. It downloads exactly once and Apple keeps no copy.

You create keys in App Store Connect under Users and Access, in the Integrations area.

Each key carries a role, and you should grant the least that does the job. Admin can touch agreements and banking. App Manager covers builds, metadata, TestFlight and submission, which is what most pipelines need. Developer is narrower and cannot submit.

The three parts are used together to sign a short lived ES256 JSON Web Token. Apple rejects tokens whose expiry is more than twenty minutes out, so keys are not bearer tokens you can paste into a curl command and reuse.

Revoke and reissue rather than sharing a key between people or systems. Revocation takes effect immediately.

See also: .p8 key, App Store Connect, Transporter.